Bluekit PhaaS randomized CSS filter pixel-hash evasion on phishing pages

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

This rule detects potentially malicious web content by identifying the use of randomized or specific combinations of CSS filters (saturate, hue-rotate, brightness, contrast) within HTML responses. These techniques are often used by attackers to obfuscate malicious content, such as phishing pages, from automated scanners and security filters. The rule also incorporates a check for unusually large JavaScript bundle sizes, which may indicate the presence of injected malicious scripts.