Attackers are using an old spam-evasion technique in a new way: hiding invisible text inside phishing emails to confuse both traditional filters and AI-powered email security tools.
Barracuda researchers reported detecting more than one million phishing attacks since April using this method, known as text salting. The campaigns were mainly retail-themed, promising rewards, points, gift cards, or urgent redemption offers to push users toward malicious links.
What Is Text Salting?
Text salting is the practice of inserting harmless-looking words, phrases, or long blocks of text into an email to change how security systems interpret the message.
To the user, the email may look like a simple phishing lure:
- “Your reward is expiring”
- “Claim your gift card”
- “Redeem your points now”
But underneath, the HTML source may contain large amounts of hidden benign text about unrelated topics such as books, puppies, training notes, or generic conversations. This dilutes the suspicious wording and can make the message appear safer to automated analysis tools.
Why AI Filters Can Be Fooled
Many AI-based email security tools analyze the raw message content, including HTML and hidden text.
That creates a gap between what the security tool reads and what the human recipient sees.
If the hidden text is positive, harmless, or unrelated, an AI model may misjudge the email’s intent, tone, or risk level. The visible phishing message remains dangerous, but the model’s interpretation is softened by invisible filler content.
This is why text salting is becoming more effective again. It does not need to defeat AI with advanced malware or complex exploits. It simply poisons the content the AI uses to make a decision.
How Attackers Hide the Text
Attackers use HTML and CSS tricks to make filler text invisible to the recipient while keeping it available to scanners.
Barracuda described several concealment methods, including:
- setting font size to zero
- shrinking text blocks with zero height
- using
clip-pathto crop content out of view - moving text off-screen with large negative indentation
- hiding overflow so no scrollbar appears
- breaking up suspicious phrases with invisible words
For example, an email might visually show “Your password expired,” while the underlying HTML contains random hidden text inserted between the words. A signature-based filter looking for the exact phrase may miss it.
Why Retail Lures Work Well
The observed campaigns often use retail-style themes because they are easy to understand and create urgency.
A fake reward, points balance, gift card, or expiring offer gives the victim a simple reason to click.
These emails may not look highly polished. Some are low-effort and obvious to a trained human. But they are designed to beat the automated controls first. Once the email lands in the inbox, the attacker only needs a small percentage of users to click.
That is what makes the technique dangerous at scale.
Trusted Infrastructure Adds Legitimacy
The campaigns also use infrastructure that can make detection harder.
Attackers used compromised legitimate websites or lookalike domains. These domains were often configured with standard email authentication such as DKIM, helping messages appear more legitimate to email systems.
This means defenders cannot rely only on one signal. An email may pass some authentication checks and still be malicious!
AI Helps Attackers Scale the Technique
AI is not only part of the defense problem. It is also helping attackers.
Large language models can generate endless variations of harmless filler text quickly and cheaply. That makes every email slightly different, reducing the effectiveness of static rules and repeated-pattern detection.
Attackers can hide a small malicious call to action inside hundreds of words of invisible benign content.
The human sees the phishing lure.
The filter sees a much larger, cleaner-looking message.
Why This Matters for Security Teams
The main lesson is that AI email security cannot rely only on raw text interpretation.
A message must be evaluated as a full object:
- what the user sees
- what the source code contains
- which text is hidden
- where links point
- how the sender behaves
- whether authentication aligns with reputation
- what action the email is trying to trigger
Barracuda recommends layered email security that evaluates structure, sender reputation, authentication results, embedded links, HTML rendering, behavioral anomalies, and the difference between visible and hidden content.
What Organizations Should Do
Organizations should review whether their email security stack can detect hidden-content abuse.
Recommended controls include:
- render emails as users see them, not only as raw HTML
- compare visible content with hidden source content
- flag excessive hidden or off-screen text
- inspect CSS tricks used to hide content
- analyze links independently of message wording
- monitor sender reputation and domain history
- detect compromised legitimate senders
- train users on reward, gift card, and urgent redemption lures
- treat AI email filtering as one layer, not the whole defense
The goal is to close the gap between machine-readable content and user-visible content.
Final Thoughts
Text salting is not new, but its return at large scale shows how attackers adapt old tricks for modern defenses.
More than one million phishing emails using hidden text prove that AI-powered security tools can still be manipulated when they analyze content differently from the human recipient.
Email security must judge the message the user actually sees, not just the words hidden inside the HTML. AI can help defenders, but only if it understands context, visibility, sender behavior, links, and intent together.
