Security researchers discovered a vulnerability that could enable cybercriminals to change the content of an email after it has been sent and dupe users into clicking on malicious URLs.

A report from security firm Mimecast outlined two possible cyberattacks involving the flaw, dubbed ROPEMAKER. The underlying approach is based on sending cascading style sheet (CSS)-laden HTML messages with files from the attacker’s server, rather than embedding the CSS code directly.

How the Vulnerability Works

Once a target victim receives the message, threat actors can use the ROPEMAKER exploit to hide a benign URL and replace it with one that links directly to malware. Another approach, called a matrix exploit, could change characters within the ASCII text of the HTML email into a malicious link.

As Infosecurity Magazine pointed out, it would be too late for most security scanning systems to catch the threat actors, since the email messages would have already been accepted.

ROPEMAKER is a good example of how tools such as CSS can be used to affect not only the way an email looks, but what actually appears inside it. According to SC Magazine, the technology operates in a dangerous area because threat actors can operate remotely even though they’re linked to a particular network. For the most part, it’s helpful to be able to fetch resources this way, but not if it exposes an organization to cyberattacks.

No Cases of ROPEMAKER in the Wild

So far, there are no reports of ROPEMAKER being used in actual cyberattacks, reported Threatpost. The exploit is also limited primarily to PC and mobile versions of programs such as Microsoft Outlook, as opposed to online email clients such as Gmail. Microsoft and Apple have been made aware of the issue but have not deemed it a serious threat to IT security.

Mimecast admitted that the matrix approach might make email messages large enough to be detected. According to Bleeping Computer, it would be fairly straightforward to prohibit remote loading of CSS resources by system administrators. Still, it’s always useful to know where potential cyberattacks are, especially in the inboxes we use every day.