Text salting: hidden email text that blinds AI security filters

What is this?

On 16 July 2026, Barracuda published a Threat Spotlight, authored by senior threat analyst Pranati Sethy, on text salting — a technique that pads phishing emails with large amounts of invisible, harmless-looking text to confuse email security systems. Barracuda says it has tracked more than one million attacks using the technique since April 2026, part of a retail-themed campaign promising rewards, points, gift cards or urgent “redeem now” offers. The same behaviour was flagged in parallel reporting from Cisco Talos.

Text salting is an old anti-spam evasion trick, but the noteworthy shift is its target. Over the past year it has migrated from confusing keyword and language filters to confusing machine-learning classifiers and, increasingly, the LLM-based analysis engines now sitting in front of the inbox. The visible email is a short, urgent lure; the hidden text is a wall of benign filler that a human never reads but a naïve classifier does.

How it works

A classic spam filter scores a message on the density of “bad” words. Text salting dilutes that density: the attacker buries the phishing content inside a large volume of innocuous text so the suspicious terms make up a smaller share of what the model reads. Barracuda’s samples pad the message with random stories and project-style notes, inflating counts of neutral words like puppy, training, notes, task, rhythm and book to drown out flags like rewards, expires or card.

The messages arrive with credible plumbing. The campaign uses compromised legitimate sites or lookalike domains configured with standard email authentication, including DKIM signing, so the envelope passes reputation and auth checks.

The concealment itself is layered — Barracuda likens it to putting three deadbolts on one door, so that if a filter defeats one trick the others still hide the text:

# Conceptual only — illustrative of the CSS/HTML tricks described, not a working payload.
clip-path: inset(100%)      # crop the render window to zero on all sides
max-height: 0; line-height: 0   # fallback: collapse the block's height
text-indent: -9999px        # shove the line ~10,000px off-screen left
overflow: hidden            # suppress the scrollbar that would reveal it
font-size: 0                # zero-font text spliced inside words

Zero-font text is also spliced inside words to break signature matching: an email whose source reads “Your pass[random text]word expired” renders to the user as “Your password expired”, while a scanner hunting the exact phrase never triggers.

Why it matters

The technique works against AI-powered filters for a specific reason: an LLM generally processes the raw text and HTML source without knowing which parts are invisible to the human recipient, unless it has been explicitly trained or instructed to ignore hidden content. Flooding the message with neutral filler can shift the model’s read of the email’s intent, sentiment and risk level — the model is swayed by text the user will never see. It is the mirror image of indirect prompt injection: rather than smuggling instructions into content the model trusts, the attacker smuggles camouflage to lower the model’s suspicion. The same “the AI reads what humans can’t see” gap underlies threats like prompt injection hidden in file metadata.

Generative AI makes it worse. Attackers can auto-generate endless, natural-sounding filler for free, so every message is unique and hard to fingerprint, and a single dangerous link can hide inside a 400-word invisible story that reads as calm and positive. Impact is bounded — this delivers phishing rather than executing code — so treat it as a high-volume delivery-evasion problem, not a system-compromise bug.

Defenses

• Analyse what the user actually sees, not just the raw source. Render the message and evaluate the visible content, so zero-font, off-screen and clipped text cannot pad the classifier’s input. This is Barracuda’s core recommendation.
• Flag divergence between rendered and source content. A large gap between user-visible text and the underlying HTML is itself a strong signal; detect and expose hidden-content abuse rather than scoring the source blindly.
• Don’t rely on keyword or single-model scoring. Combine content analysis with message structure, sender reputation, authentication results, behavioural anomalies and embedded-link inspection, so diluting one signal doesn’t clear the message.
• Instruct LLM analysers to ignore non-visible content. If a model must read raw HTML, strip or down-weight zero-size, clipped and off-canvas text before classification, and treat unusual concealment CSS as suspicious in its own right.
• Keep humans trained. Authentication passing (including DKIM) does not mean a message is safe; pair tooling with regular awareness training on retail-reward and “expiring points” lures.

Status

Item	Detail
Reported by	Barracuda (Threat Spotlight, Pranati Sethy); corroborated by Cisco Talos
First seen	April 2026; spotlight published 16 July 2026
Volume	1,000,000+ messages tracked
Lure	Retail rewards / points / gift-card “redeem now” phishing
Class	Detection evasion of AI/LLM email filters via hidden (“salted”) text
Impact	Phishing delivery — no code execution

Text salting is a reminder that AI classifiers inherit an old web problem: the model’s input is the source, but the victim’s experience is the render. Any defence that scores the bytes without accounting for what a human would actually see can be diluted into a wrong answer.