Hello and welcome to the Monday, November 24, 2025 edition of the Sands Internet Storm Center's Stormcast.

My name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the sands.edu undergraduate certificate program in cybersecurity fundamentals.

Jan came across an interesting new technique, how attackers are possibly attempting to better obfuscate their fishing pages.

This started with a standard email fish, nothing really all too exciting here.

Now, one of the goals often of attackers is to make the email or the web page look different to the user than it looks to an automated system.

And that's how we sometimes have cascading style sheets being used to, for example, mark certain text as invisible. But then, of course,

a simple detection engine may not necessarily notice this. Here, the cascading style sheets are used

a little bit different. What Jan suggests is that in this case, the attacker just added cascading

style sheets to make the page larger and with that

less likely going to be detected as malicious. The reason behind this is twofold. First of all,

some detection engines do have an upper limit as to how much text or so they're actually going to scan. So just by adding a lot

of text and here I think we're dealing with about half a megabyte. They may attempt to sort of

exceed that boundary. The other thing is that the cascading style sheet being added to the

HTML page here is actually, well, just a fairly common bootstrap cascading

style sheet. It's copy-paces, not included as it's usually being done. So it's not necessarily

something where an attacker just added it because they may need a feature. And apparently they're

not actually using any features from this cascading style sheet.

They're really just using it to pat the content.

And by padding it with very common benign content, of course, they may also slip past some detection engines.

And last week I talked about the critical critical vulnerability in Oracle Identity Manager,

where Searchlight Cyber had an article about this vulnerability and basically explained in

...