CSS-bomb keylogger exfil via mass near-identical background-image URLs in email body

Ankit Mehta@Secvyn

•updated Aug 9, 2026•3•0•4

This rule detects potential data exfiltration via email by identifying mass near-identical background-image URLs in the body of an email. The rule looks for a high volume (8+) of distinct URLs that contain short parameters (indicative of encoded or smuggled data) within a single email. It further refines the detection by checking for the presence of specific CSS-like syntax often used in CSS-injection keylogging techniques to force the browser or email client to send background-image requests.