Hidden-Text Phishing Campaigns Evade AI Email Filters

Attackers have sent more than 1 million retail-themed phishing emails since April using hidden-text "text salting" to bypass both traditional secure email gateways and newer AI-driven email defenses, according to Barracuda Networks. The messages typically promise rewards, loyalty points, or gift cards and pressure recipients with urgent calls to action that lead to malicious links. Barracuda said some campaigns also used DKIM authentication, lookalike domains, and compromised legitimate websites to improve delivery and credibility.

The evasion technique manipulates HTML and CSS so benign filler text is exposed to automated scanners but not to human readers, including by setting font size to zero, placing text in zero-sized containers, cropping content, or pushing text off-screen. Researchers warned that machine-learning and LLM-based filters can be misled when they analyze raw text or source code without distinguishing visible from hidden content. Barracuda urged defenders to use layered controls that combine sender reputation, authentication checks, URL inspection, HTML-rendering analysis, and comparison of visible versus hidden content and user-requested actions.