Text-Salting Phishing Campaigns Abuse CSS-Hidden Text to Evade AI Email Security Filters — Threadlinqs Intelligence
As of 2026-07-16, Text-Salting Phishing Campaigns Abuse CSS-Hidden Text to Evade AI Email Security Filters is a medium-severity phishing threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 19 indicators of compromise.
Threat ID: TL-2026-1426 · Severity: MEDIUM · Status: ACTIVE · Category: PHISHING
Barracuda researchers have detected over one million phishing attacks since April 2026 using a technique dubbed 'text salting' — CSS tricks and zero-point font injection hide large volumes of benign,
Barracuda's threat research team has identified an escalating adversarial-content technique against AI-powered email security filters, which the vendor calls 'text salting.' The technique conceals large amounts of innocuous, high-reputation-sounding text — cloned brand newsletter copy, fiction/story content, generic conversational or project-style notes — inside the raw HTML/DOM of a phishing email using CSS and font rendering tricks, so that the text is never visible to the human recipient but is fully present in the source code that AI/LLM-based classifiers, sentiment analyzers, and keyword/ML detectors ingest.
The core insight exploited is architectural: large language models and other AI content classifiers used in modern email security stacks process raw source text/HTML rather than rendered visual output, and cannot inherently distinguish 'content a human will see' from 'content injected purely to manipulate the model.' By diluting the concentration of suspicious keywords (rewards, expires, card, password) with high counts of benign, unrelated terms (puppy, training, notes, task, rhythm, book) and coherent-sounding filler paragraphs generated cheaply at scale with generative AI, attackers shift the model's sentiment, intent, and risk classification toward 'legitimate,' allowing the phishing payload to reach the inbox.
Observed concealment mechanics fall into three families: (1) viewport/box cropping — `clip-path: inset(100%)`, `max-height:0` combined with `line-height:0` to collapse vertical space without leaving a rendering gap; (2) off-screen displacement — `text-indent:-9999px` pushing text thousands of pixels outside the visible canvas combined with `overflow:hidden` to suppress the resulting scrollbar; and (3) font manipulation — zero/near-zero `font-size` injection of disruptive or randomized tokens directly inside legitimate sentences (e.g. 'Your pass[random]word expired') to break up signature/keyword-based detection strings while remaining invisible to the reader.
Barracuda reports more than one million phishing attacks using this technique since April 2026, predominantly retail-themed lures (urgent rewards/points expiration, gift-card redemption offers) impersonating well-known brands, with attackers pairing the hidden-text payload with compromised legitimate sending domains or convincing lookalike domains configured with valid DKIM signing to additionally defeat traditional authentication-based email security controls. The vendor situates this inside a broader 2026 trend of AI/phishing-as-a-service driven email threats: Barracuda's wider research shows phishing constitutes roughly 48% of malicious email activity, roughly 1 in 3 of 3.1 billion emails analyzed in January 2026 were malicious/spam, and 90% of high-volume phishing campaigns now use phishing-as-a-service kits, all of which lower the cost of producing large volumes of AI-generated filler content needed to run a text-salting campaign at scale.
This is a filter/model-evasion technique rather than a software vulnerability — there is no CVE. It is conceptually adjacent to MITRE ATLAS AML.T0068 (LLM Prompt Obfuscation, under the Defense Evasion tactic), which documents adversaries hiding or obfuscating injected content from LLM-based guardrails using near-identical mechanisms (small/zero font size, background-matched text color, hidden HTML elements) to evade detection by AI systems, and to indirect prompt injection (AML.T0051), where an LLM-based classifier ingests attacker-controlled hidden content embedded in an email/document it is asked to evaluate. Currently text-salted messages represent under 1% of observed email traffic per Barracuda, but the vendor flags the technique as an early, fast-growing signal of attacker tradecraft purpose-built to target AI-based (rather than purely rule-based) email security products.
Target sectors: retail, finance, health, insurance, cross-sector
Target regions: Global
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 19 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
PHISHING, MEDIUM, threat intelligence, cybersecurity, T1586, T1583, T1587, T1566, T1027, T1684.001, T1036, AML.T0068, AML.T0051, T1114
