H265 — Graymail

| Filter | Detection Rate (Graymail) | False Positive (legit video) | |--------|----------------------------|-------------------------------| | Gmail | 4% | 0.5% | | Outlook | 12% | 1.0% | | Proofpoint | 8% | 2.0% | | SpamAssassin | 28% (via Razor2 URL check after decode) | 0% |

However, graymail exists in a legal and operational gray zone: blocking it outright may delete a user's shopping receipt or password reset. Thus, filters apply reduced suspicion to patterns resembling legitimate bulk mail. Attackers have begun exploiting this reduced suspicion window. The state of the art (Asghar et al., 2021) showed that PDF and DOCX can hide graymail via font substitution. We extend this to , specifically H.265, which offers three unique advantages: graymail h265

Graymail—legitimate but unwanted bulk email (newsletters, marketing, alerts)—constitutes over 60% of enterprise inbox traffic, yet remains difficult to filter without risking false positives on critical mail. Traditional content analysis relies on text extraction, URL reputation, and structural heuristics. This paper introduces a novel evasion vector: embedding graymail payloads within H.265 (High Efficiency Video Coding, HEVC) attachments. By exploiting HEVC’s advanced compression features—specifically, Prediction Units (PUs), Transform Skip (TS), and SEI (Supplemental Enhancement Information) messages—adversaries can craft video files that, when decoded, render a marketing message or call-to-action, but whose pre-decoding entropy and token distribution evade NLP-based classifiers. We demonstrate a prototype encoder ( GrayMail265 ) that achieves a 94% bypass rate against three major commercial email filters (Gmail, Outlook, Proofpoint) while maintaining a file size under 300KB. We conclude with mitigations based on HEVC parsing fingerprinting. | Filter | Detection Rate (Graymail) | False