Loading story…
Attackers are increasingly leveraging cascading style sheets (CSS) to insert hidden text and irrelevant content into emails, a tactic known as hidden text salting, to evade detection by email security solutions. Cisco Talos has been monitoring this trend for over a year, observing a significant rise in the use of CSS-based hidden content in both spam and malicious emails. The technique involves embedding random characters, nonsense paragraphs, and hidden comments within various parts of an email, such as the preheader, header, attachments, and body. These elements are manipulated using CSS properties that control text visibility and sizing, making the added content invisible to the recipient but confusing to automated detection systems. This method is particularly effective at bypassing both traditional spam filters and advanced machine learning-based email defenses, as it introduces noise that can disrupt keyword-based and pattern-matching algorithms. Cisco Talos has reported on this tactic multiple times throughout 2025, noting a steady increase in its adoption by threat actors. The abuse of CSS for hidden text salting is not limited to a single campaign but is widespread across various email threats, making it a substantial challenge for enterprise security teams. Researchers highlight that while CSS is a legitimate tool for enhancing email appearance and branding, its misuse for content concealment is now a common feature in malicious campaigns. The prevalence of hidden text salting in spam and phishing emails far exceeds its occurrence in legitimate communications, underscoring its role as a deliberate evasion strategy. Security experts warn that this technique can also impact the effectiveness of large language model (LLM)-based defense solutions, which may be particularly susceptible to poisoned or noisy input. The ongoing evolution of this tactic demonstrates the adaptability of threat actors in circumventing security controls. Cisco Talos has shared key findings with the security community to raise awareness and encourage the development of more robust detection mechanisms. The research emphasizes the need for email security solutions to account for hidden and obfuscated content, not just visible text. Organizations are advised to review their email filtering rules and consider enhancements that can detect and neutralize hidden text salting. The continued monitoring and reporting by Cisco Talos provide valuable intelligence for defenders seeking to stay ahead of these evolving email-based threats.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On 2025-10-07, Cisco Talos published research describing attackers' abuse of CSS to hide salted text in spam messages, and Dark Reading reported on the same technique the same day. The references indicate public disclosure of the tactic but do not provide earlier dated events such as a first observed campaign, victim disclosure, or remediation milestone.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers have sent more than **1 million retail-themed phishing emails** since April using hidden-text **"text salting"** to bypass both traditional secure email gateways and newer AI-driven email defenses, according to Barracuda Networks. The messages typically promise rewards, loyalty points, or gift cards and pressure recipients with urgent calls to action that lead to malicious links. Barracuda said some campaigns also used **DKIM** authentication, lookalike domains, and compromised legitimate websites to improve delivery and credibility. The evasion technique manipulates HTML and CSS so benign filler text is exposed to automated scanners but not to human readers, including by setting font size to zero, placing text in zero-sized containers, cropping content, or pushing text off-screen. Researchers warned that machine-learning and **LLM-based** filters can be misled when they analyze raw text or source code without distinguishing visible from hidden content. Barracuda urged defenders to use layered controls that combine sender reputation, authentication checks, URL inspection, HTML-rendering analysis, and comparison of visible versus hidden content and user-requested actions.
Jul 24, 2026
Security researchers reported multiple **phishing evasion** techniques designed to defeat modern email and AI-assisted defenses rather than relying only on traditional lure quality. One campaign analyzed by KnowBe4 used **graymail-style content padding** and extreme whitespace insertion to manipulate NLP-based email security tools, placing benign promotional text, legitimate signatures, and trusted links far below the visible phishing lure so scanners would weigh the message as less malicious. A separate LevelBlue-tracked trend showed attackers abusing enterprise **URL rewriting** and *Safe Links*-style protections by sending phishing through compromised accounts, causing security gateways to generate trusted wrapped URLs that could then be reused in campaigns targeting **Microsoft 365** users. The activity reflects a broader shift toward exploiting the gap between what users see and what automated systems inspect. In the URL-rewriting abuse, operators tied to **Tycoon2FA** and **Sneaky2FA** built multi-layer redirect chains across several trusted vendor domains to obscure final destinations and steal credentials and MFA session cookies through adversary-in-the-middle infrastructure, enabling account takeover, internal phishing, data theft, and sometimes ransomware follow-on activity. Related research from LayerX showed a different but thematically aligned evasion method in which **font rendering and CSS** make webpages display malicious commands to users while AI assistants parsing the underlying HTML see only harmless text, underscoring that attackers are increasingly targeting AI and trust-based inspection layers as part of phishing and social-engineering operations.
Jun 29, 2026
Cybercriminals have significantly increased the use of concealed JavaScript and steganography to deliver malware through business-themed email attacks in the third quarter of 2025. Security researchers at Forcepoint X-Labs observed a surge in malicious emails disguised as legitimate business communications, such as purchase orders, shipment notifications, and payment requests. These emails often contain compressed archive attachments (ZIP, RAR, 7z, or TAR) that include heavily obfuscated JavaScript files. The obfuscation is designed to evade detection by security tools, making it difficult for traditional email filters to identify the threat. Once a recipient opens the JavaScript file, it leverages legitimate Windows utilities like PowerShell and Windows Management Instrumentation (WMI) to execute commands, a technique known as 'Living off the Land' (LotL). This approach allows attackers to operate without raising immediate suspicion or triggering standard security alerts. A notable aspect of these campaigns is the use of steganography, where malicious code is hidden within seemingly innocuous image files. The JavaScript downloader decodes Base64-encoded DLL or EXE payloads embedded in these images, further complicating detection. Payloads identified in these attacks include well-known malware families such as Agent Tesla, Remcos RAT, DarkCloud, and FormBook, each capable of stealing sensitive information or providing remote access to compromised systems. The campaigns are highly targeted, with lures localized in multiple languages, including English and Spanish, to increase their effectiveness against non-English speaking businesses. Subject lines like “RE: Payment Swift MT103” and “DHL Shipment Notification” are commonly used to entice recipients into opening the attachments. The sophistication of these attacks, including the use of legitimate system tools and advanced concealment techniques, allows them to bypass many conventional security defenses. Security experts recommend organizations implement advanced email filtering, strengthen endpoint security, and conduct regular user awareness training to mitigate the risk. The trend highlights the evolving tactics of threat actors who continuously adapt to evade detection and maximize the impact of their campaigns. Organizations are urged to remain vigilant and update their security protocols to address these emerging threats. The use of steganography in malware delivery represents a significant challenge for defenders, as it requires more advanced analysis to uncover hidden payloads. The ongoing evolution of these attack methods underscores the importance of a multi-layered security approach. Businesses are advised to monitor for unusual activity related to PowerShell and WMI, as these are commonly abused in such attacks. The widespread nature of these campaigns suggests that organizations of all sizes and sectors are at risk. Collaboration between security vendors and enterprises is essential to develop effective countermeasures. The research underscores the need for continuous threat intelligence sharing to stay ahead of rapidly changing attack techniques. Ultimately, the rise in JavaScript and steganography-based malware delivery marks a new phase in email-borne threats, demanding heightened awareness and proactive defense strategies.
Jun 29, 2026