Running an HTML code via Notepad in Windows 11/10 is a super easy task. If you are not sure how, well, you are in the right place.

But CSS Exfil is not an infallible method. It can only steal HTML attributes found on the page at load time, and not from dynamically injected code after the initial page load.

By appending just a few lines of HTML and CSS code, researcher Louis Dion-Marcil showed how an external sender could hide the very warning from an email message.