Loading story…
Attackers have sent more than 1 million retail-themed phishing emails since April using hidden-text "text salting" to bypass both traditional secure email gateways and newer AI-driven email defenses, according to Barracuda Networks. The messages typically promise rewards, loyalty points, or gift cards and pressure recipients with urgent calls to action that lead to malicious links. Barracuda said some campaigns also used DKIM authentication, lookalike domains, and compromised legitimate websites to improve delivery and credibility.
The evasion technique manipulates HTML and CSS so benign filler text is exposed to automated scanners but not to human readers, including by setting font size to zero, placing text in zero-sized containers, cropping content, or pushing text off-screen. Researchers warned that machine-learning and LLM-based filters can be misled when they analyze raw text or source code without distinguishing visible from hidden content. Barracuda urged defenders to use layered controls that combine sender reputation, authentication checks, URL inspection, HTML-rendering analysis, and comparison of visible versus hidden content and user-requested actions.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Barracuda Networks reported detecting more than one million retail-themed phishing emails using hidden-text "text salting" techniques since April 2026. The campaigns used concealed benign text in HTML/CSS to evade automated email security analysis while luring users with rewards, points, or gift card themes.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
6 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecyberveille.ch
Open sourcescworld.com
Open sourcetheregister.com
Open sourcedarkreading.com
Open sourceblog.barracuda.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple **phishing evasion** techniques designed to defeat modern email and AI-assisted defenses rather than relying only on traditional lure quality. One campaign analyzed by KnowBe4 used **graymail-style content padding** and extreme whitespace insertion to manipulate NLP-based email security tools, placing benign promotional text, legitimate signatures, and trusted links far below the visible phishing lure so scanners would weigh the message as less malicious. A separate LevelBlue-tracked trend showed attackers abusing enterprise **URL rewriting** and *Safe Links*-style protections by sending phishing through compromised accounts, causing security gateways to generate trusted wrapped URLs that could then be reused in campaigns targeting **Microsoft 365** users. The activity reflects a broader shift toward exploiting the gap between what users see and what automated systems inspect. In the URL-rewriting abuse, operators tied to **Tycoon2FA** and **Sneaky2FA** built multi-layer redirect chains across several trusted vendor domains to obscure final destinations and steal credentials and MFA session cookies through adversary-in-the-middle infrastructure, enabling account takeover, internal phishing, data theft, and sometimes ransomware follow-on activity. Related research from LayerX showed a different but thematically aligned evasion method in which **font rendering and CSS** make webpages display malicious commands to users while AI assistants parsing the underlying HTML see only harmless text, underscoring that attackers are increasingly targeting AI and trust-based inspection layers as part of phishing and social-engineering operations.
Jun 29, 2026
Attackers are increasingly leveraging cascading style sheets (CSS) to insert hidden text and irrelevant content into emails, a tactic known as hidden text salting, to evade detection by email security solutions. Cisco Talos has been monitoring this trend for over a year, observing a significant rise in the use of CSS-based hidden content in both spam and malicious emails. The technique involves embedding random characters, nonsense paragraphs, and hidden comments within various parts of an email, such as the preheader, header, attachments, and body. These elements are manipulated using CSS properties that control text visibility and sizing, making the added content invisible to the recipient but confusing to automated detection systems. This method is particularly effective at bypassing both traditional spam filters and advanced machine learning-based email defenses, as it introduces noise that can disrupt keyword-based and pattern-matching algorithms. Cisco Talos has reported on this tactic multiple times throughout 2025, noting a steady increase in its adoption by threat actors. The abuse of CSS for hidden text salting is not limited to a single campaign but is widespread across various email threats, making it a substantial challenge for enterprise security teams. Researchers highlight that while CSS is a legitimate tool for enhancing email appearance and branding, its misuse for content concealment is now a common feature in malicious campaigns. The prevalence of hidden text salting in spam and phishing emails far exceeds its occurrence in legitimate communications, underscoring its role as a deliberate evasion strategy. Security experts warn that this technique can also impact the effectiveness of large language model (LLM)-based defense solutions, which may be particularly susceptible to poisoned or noisy input. The ongoing evolution of this tactic demonstrates the adaptability of threat actors in circumventing security controls. Cisco Talos has shared key findings with the security community to raise awareness and encourage the development of more robust detection mechanisms. The research emphasizes the need for email security solutions to account for hidden and obfuscated content, not just visible text. Organizations are advised to review their email filtering rules and consider enhancements that can detect and neutralize hidden text salting. The continued monitoring and reporting by Cisco Talos provide valuable intelligence for defenders seeking to stay ahead of these evolving email-based threats.
Jun 29, 2026
Cybercriminals are increasingly using **HTML attachments** in phishing emails to evade detection and steal credentials, embedding malicious logic directly in attached files instead of placing suspicious links in the message body. The attachments commonly use JavaScript to redirect victims to fraudulent login pages or to display a complete phishing page locally inside the browser, making the email appear less obviously malicious to both users and some security controls. Researchers found that attackers also obfuscate these attachments to hinder static analysis, including hiding phishing URLs, concealing entire scripts, and using deprecated JavaScript functions such as `unescape()` to decode and render phishing content at runtime. Kaspersky reported detecting nearly **2 million** emails carrying malicious HTML attachments in the first four months of 2022, including **851,328** blocked in March alone, underscoring how effective and persistent the technique remains for credential-harvesting campaigns.
Aug 15, 2026