Loading story…
Attackers have sent more than 1 million retail-themed phishing emails since April using hidden-text "text salting" to bypass both traditional secure email gateways and newer AI-driven email defenses, according to Barracuda Networks. The messages typically promise rewards, loyalty points, or gift cards and pressure recipients with urgent calls to action that lead to malicious links. Barracuda said some campaigns also used DKIM authentication, lookalike domains, and compromised legitimate websites to improve delivery and credibility.
The evasion technique manipulates HTML and CSS so benign filler text is exposed to automated scanners but not to human readers, including by setting font size to zero, placing text in zero-sized containers, cropping content, or pushing text off-screen. Researchers warned that machine-learning and LLM-based filters can be misled when they analyze raw text or source code without distinguishing visible from hidden content. Barracuda urged defenders to use layered controls that combine sender reputation, authentication checks, URL inspection, HTML-rendering analysis, and comparison of visible versus hidden content and user-requested actions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Barracuda Networks reported detecting more than one million retail-themed phishing emails using hidden-text "text salting" techniques since April 2026. The campaigns used concealed benign text in HTML/CSS to evade automated email security analysis while luring users with rewards, points, or gift card themes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecyberveille.ch
Open sourcescworld.com
Open sourcetheregister.com
Open sourcedarkreading.com
Open sourceblog.barracuda.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple **phishing evasion** techniques designed to defeat modern email and AI-assisted defenses rather than relying only on traditional lure quality. One campaign analyzed by KnowBe4 used **graymail-style content padding** and extreme whitespace insertion to manipulate NLP-based email security tools, placing benign promotional text, legitimate signatures, and trusted links far below the visible phishing lure so scanners would weigh the message as less malicious. A separate LevelBlue-tracked trend showed attackers abusing enterprise **URL rewriting** and *Safe Links*-style protections by sending phishing through compromised accounts, causing security gateways to generate trusted wrapped URLs that could then be reused in campaigns targeting **Microsoft 365** users. The activity reflects a broader shift toward exploiting the gap between what users see and what automated systems inspect. In the URL-rewriting abuse, operators tied to **Tycoon2FA** and **Sneaky2FA** built multi-layer redirect chains across several trusted vendor domains to obscure final destinations and steal credentials and MFA session cookies through adversary-in-the-middle infrastructure, enabling account takeover, internal phishing, data theft, and sometimes ransomware follow-on activity. Related research from LayerX showed a different but thematically aligned evasion method in which **font rendering and CSS** make webpages display malicious commands to users while AI assistants parsing the underlying HTML see only harmless text, underscoring that attackers are increasingly targeting AI and trust-based inspection layers as part of phishing and social-engineering operations.
Jun 29, 2026
Attackers are increasingly leveraging cascading style sheets (CSS) to insert hidden text and irrelevant content into emails, a tactic known as hidden text salting, to evade detection by email security solutions. Cisco Talos has been monitoring this trend for over a year, observing a significant rise in the use of CSS-based hidden content in both spam and malicious emails. The technique involves embedding random characters, nonsense paragraphs, and hidden comments within various parts of an email, such as the preheader, header, attachments, and body. These elements are manipulated using CSS properties that control text visibility and sizing, making the added content invisible to the recipient but confusing to automated detection systems. This method is particularly effective at bypassing both traditional spam filters and advanced machine learning-based email defenses, as it introduces noise that can disrupt keyword-based and pattern-matching algorithms. Cisco Talos has reported on this tactic multiple times throughout 2025, noting a steady increase in its adoption by threat actors. The abuse of CSS for hidden text salting is not limited to a single campaign but is widespread across various email threats, making it a substantial challenge for enterprise security teams. Researchers highlight that while CSS is a legitimate tool for enhancing email appearance and branding, its misuse for content concealment is now a common feature in malicious campaigns. The prevalence of hidden text salting in spam and phishing emails far exceeds its occurrence in legitimate communications, underscoring its role as a deliberate evasion strategy. Security experts warn that this technique can also impact the effectiveness of large language model (LLM)-based defense solutions, which may be particularly susceptible to poisoned or noisy input. The ongoing evolution of this tactic demonstrates the adaptability of threat actors in circumventing security controls. Cisco Talos has shared key findings with the security community to raise awareness and encourage the development of more robust detection mechanisms. The research emphasizes the need for email security solutions to account for hidden and obfuscated content, not just visible text. Organizations are advised to review their email filtering rules and consider enhancements that can detect and neutralize hidden text salting. The continued monitoring and reporting by Cisco Talos provide valuable intelligence for defenders seeking to stay ahead of these evolving email-based threats.
Jun 29, 2026
Cybercriminals are increasingly leveraging artificial intelligence and advanced social engineering techniques to conduct sophisticated phishing campaigns targeting both individuals and organizations. Recent reports highlight a surge in phishing attacks that utilize AI and machine learning to craft highly personalized and convincing lures, making detection more challenging for traditional security tools. Attackers are now able to scrape social media for personal data, generate emails in a target’s native language, and automate the creation of malicious content, all with minimal effort. One notable campaign tracked since February targets social media and marketing professionals by impersonating well-known brands such as Tesla, Red Bull, and Ferrari, enticing victims to upload resumes under the guise of job opportunities. These emails employ subtle psychological tactics, such as reducing urgency to build trust, and use multi-step processes to create an illusion of legitimacy. Another observed campaign used AI to obfuscate malicious payloads within SVG files, making them harder for security filters to detect. In this case, attackers sent phishing emails from compromised small business accounts, posing as file-sharing notifications, and used self-addressed email tactics to bypass basic detection heuristics. If recipients opened the attached file, they were redirected to credential-stealing websites. Microsoft researchers noted that the complexity and structure of the malicious code suggested it was generated by a large language model, rather than written by a human. The adoption of AI by threat actors is part of a broader trend, with both defenders and attackers racing to outpace each other in the use of transformative technologies. Security experts emphasize the importance of a layered defense, recommending strong passwords, multi-factor authentication, regular software updates, and ongoing user training to identify and report suspicious content. The rise of AI-driven phishing has increased the frequency and sophistication of attacks, with some security centers now detecting a malicious email every 42 seconds. Organizations are urged to remain vigilant, as even basic threat actors can now execute complex attacks with the help of AI tools. The evolving threat landscape underscores the need for proactive monitoring, rapid incident response, and continuous education to mitigate the risks posed by these advanced phishing campaigns. As attackers continue to refine their methods, defenders must adapt by leveraging AI for detection and response, and by fostering a security-aware culture among users. The convergence of AI and phishing represents a significant escalation in cyber risk, demanding heightened attention from both technical and non-technical stakeholders.
Jul 12, 2026