The Mimecast Threat Research team has identified a sophisticated HTML obfuscation technique employed by threat actors to evade email security detection systems. This method leverages the legitimate HTML <bdo> (Bi-Directional Override) and <cite> tags in combination with CSS styling to hide malicious content within seemingly legitimate email communications. This obfuscation technique represents an evolution in email-based evasion methods, demonstrating threat actors' continued adaptation to security controls. By exploiting the legitimate functionality of HTML tags designed for text formatting and citation purposes, attackers can embed hidden content that bypasses traditional content-based detection while maintaining the visual appearance of legitimate communications.
BDO Tag Exploitation
The <bdo> tag is traditionally designed to control text direction in HTML documents, specifically handling right-to-left (RTL) and left-to-right (LTR) text formatting through the dir attribute. However, threat actors are exploiting this tag without proper directional values, instead using it as a container for obfuscated content.
Malicious Implementation:
In this example, the legitimate text "© 2025 Microsoft." is obfuscated by inserting random alphanumeric characters within BDO tags, breaking up the readable content while maintaining the overall structure.
CITE Tag Exploitation
The <cite> tag is intended to mark up the title of creative works and is typically displayed in italics by default. Threat actors are repurposing this tag to hide obfuscated content within legitimate-appearing text.
Malicious Implementation:
Similar to the BDO technique, this method fragments the "© 2025 Microsoft." text by inserting random characters within CITE tags, creating visual obfuscation while maintaining the underlying message structure.
CSS-Based Invisibility
The critical component of this obfuscation technique relies on CSS styling that renders the malicious content invisible to end users while preserving its presence in the HTML source code.
BDO Tag Styling:
CITE Tag Styling:
The font-size: 0 declaration ensures that regardless of the font family specified, the obfuscated text remains invisible when rendered by email clients. This technique effectively hides the malicious content from users while potentially evading security systems that analyze visible content.
Below is an example of a campaign using this technique, left side showing the raw html and the right-hand side when the email is rendered in Outlook.
This technique demonstrates several sophisticated evasion characteristics:
The evolution of HTML-based obfuscation techniques demonstrates the importance of maintaining advanced detection capabilities that can analyze both the technical structure and visual presentation of email content. Organizations should ensure their security controls can effectively identify and mitigate these sophisticated evasion methods.
Mimecast has implemented advanced HTML analysis capabilities to detect CSS-based obfuscation techniques, including those utilizing BDO and CITE tags. Our detection systems analyze both the HTML structure and the CSS styling to identify content that may be hidden from users while remaining present in the source code.
This technique has been observed across various industries and geographic regions, with particular focus on campaigns impersonating trusted technology brands and services.
HTML Patterns:
CSS Indicators:
Security Awareness:
Proactive Threat Hunting:
Discover how Mimecast’s single platform can protect your people, AI, and data.
Join thousands of security professionals using our curated alerts, expert analysis, and campaign IOCs to defend against emerging cyber threats.
Threat IntelligenceSep 1, 2026
Threat IntelligenceAug 27, 2026
