Text-Salting Phishing Campaigns Abuse CSS-Hidden Text to Evade AI Email Security Filters
Text-Salting Phishing Campaigns Abuse CSS-Hidden Text to (TL-2026-1426), also tracked as Text Salting, is a medium-severity phishing campaign, first published 2026-07-16. It has no confirmed attribution, affects Generic AI/LLM-based email security filtering products, maps to 22 MITRE ATT&CK / ATLAS techniques (AML.T0051, AML.T0068, T1027), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-1426
- Threat ID
- TL-2026-1426
- Also known as
- Text Salting
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-07-16
- Last reviewed
- 2026-07-16
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- retail, finance, health, insurance, cross-sector
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in Text-Salting Phishing Campaigns Abuse CSS-Hidden Text to
Malware and tooling: text-salting-phishing-html, Evilginx
Barracuda researchers have detected over one million phishing attacks since April 2026 using a technique dubbed 'text salting' — CSS tricks and zero-point font injection hide large volumes of benign, high-reputation text inside emails so AI/LLM-based email security filters misclassify the message as legitimate, while the recipient sees only the malicious phishing content.
How Text-Salting Phishing Campaigns Abuse CSS-Hidden Text to works
Barracuda's threat research team has identified an escalating adversarial-content technique against AI-powered email security filters, which the vendor calls 'text salting.' The technique conceals large amounts of innocuous, high-reputation-sounding text — cloned brand newsletter copy, fiction/story content, generic conversational or project-style notes — inside the raw HTML/DOM of a phishing email using CSS and font rendering tricks, so that the text is never visible to the human recipient but is fully present in the source code that AI/LLM-based classifiers, sentiment analyzers, and keyword/ML detectors ingest.
The core insight exploited is architectural: large language models and other AI content classifiers used in modern email security stacks process raw source text/HTML rather than rendered visual output, and cannot inherently distinguish 'content a human will see' from 'content injected purely to manipulate the model.' By diluting the concentration of suspicious keywords (rewards, expires, card, password) with high counts of benign, unrelated terms (puppy, training, notes, task, rhythm, book) and coherent-sounding filler paragraphs generated cheaply at scale with generative AI, attackers shift the model's sentiment, intent, and risk classification toward 'legitimate,' allowing the phishing payload to reach the inbox.
Observed concealment mechanics fall into three families: (1) viewport/box cropping — `clip-path: inset(100%)`, `max-height:0` combined with `line-height:0` to collapse vertical space without leaving a rendering gap; (2) off-screen displacement — `text-indent:-9999px` pushing text thousands of pixels outside the visible canvas combined with `overflow:hidden` to suppress the resulting scrollbar; and (3) font manipulation — zero/near-zero `font-size` injection of disruptive or randomized tokens directly inside legitimate sentences (e.g. 'Your pass[random]word expired') to break up signature/keyword-based detection strings while remaining invisible to the reader.
Barracuda reports more than one million phishing attacks using this technique since April 2026, predominantly retail-themed lures (urgent rewards/points expiration, gift-card redemption offers) impersonating well-known brands, with attackers pairing the hidden-text payload with compromised legitimate sending domains or convincing lookalike domains configured with valid DKIM signing to additionally defeat traditional authentication-based email security controls. The vendor situates this inside a broader 2026 trend of AI/phishing-as-a-service driven email threats: Barracuda's wider research shows phishing constitutes roughly 48% of malicious email activity, roughly 1 in 3 of 3.1 billion emails analyzed in January 2026 were malicious/spam, and 90% of high-volume phishing campaigns now use phishing-as-a-service kits, all of which lower the cost of producing large volumes of AI-generated filler content needed to run a text-salting campaign at scale.
This is a filter/model-evasion technique rather than a software vulnerability — there is no CVE. It is conceptually adjacent to MITRE ATLAS AML.T0068 (LLM Prompt Obfuscation, under the Defense Evasion tactic), which documents adversaries hiding or obfuscating injected content from LLM-based guardrails using near-identical mechanisms (small/zero font size, background-matched text color, hidden HTML elements) to evade detection by AI systems, and to indirect prompt injection (AML.T0051), where an LLM-based classifier ingests attacker-controlled hidden content embedded in an email/document it is asked to evaluate. Currently text-salted messages represent under 1% of observed email traffic per Barracuda, but the vendor flags the technique as an early, fast-growing signal of attacker tradecraft purpose-built to target AI-based (rather than purely rule-based) email security products.
MITRE ATT&CK / ATLAS techniques used in TL-2026-1426
execution
AML.T0051 LLM Prompt Injection
defense-evasion
AML.T0068 LLM Prompt Obfuscation
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading
Persistence
T1053 Scheduled Task/Job; T1098 Account Manipulation; T1546 Event Triggered Execution; T1547 Boot or Logon Autostart Execution
Credential Access
T1056 Input Capture; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
Collection
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1587 Develop Capabilities
Impact
stealth
defense-impairment
Affected products and versions in Text-Salting Phishing Campaigns Abuse CSS-Hidden Text to
- Generic — AI/LLM-based email security filtering products
Vulnerable versions: AI/ML content classifiers that ingest raw HTML/source text without rendering-aware sanitization
Fixed in: Products adding hidden-content/visible-vs-source diffing and layered non-AI detection controls
Remediation for Text-Salting Phishing Campaigns Abuse CSS-Hidden Text to
Immediate actions
- Deploy hidden-content detection that diffs rendered/visible DOM output against the raw HTML/source text ingested by content classifiers, flagging large visible/invisible text discrepancies
- Add heuristic rules to flag CSS properties commonly abused for text concealment (clip-path: inset(100%), max-height:0 combined with line-height:0, text-indent beyond viewport bounds, overflow:hidden masking off-canvas content, zero or near-zero font-size spans)
- Do not rely solely on LLM/AI sentiment or intent classification for phishing verdicts — require corroborating signal from sender authentication (SPF/DKIM/DMARC alignment), URL reputation, and structural/behavioral heuristics
- Flag messages with anomalously high hidden-to-visible text ratios for quarantine or secondary review
Workarounds
- User/employee training to recognize retail rewards/gift-card urgency lures independent of technical filtering outcome
- Enforce strict DKIM/DMARC alignment checks and flag mail from domains with recent reputation changes or newly observed DKIM keys
Longer-term hardening
- Harden AI/LLM-based email classifiers against indirect prompt injection and content-obfuscation techniques (treat email HTML as untrusted input to the model, strip or separately flag non-rendered content before classification)
- Layer AI-based filtering with traditional signature, reputation, and authentication-based controls rather than treating AI classification as the sole or final gate
- Continuously retrain/red-team AI email security models against known evasion techniques (text salting, zero-width characters, homoglyphs) as adversaries iterate
- Monitor phishing-as-a-service kit marketplaces and threat intel feeds for adoption of text-salting templates
Timeline of Text-Salting Phishing Campaigns Abuse CSS-Hidden Text to
- Barracuda's January 2026 traffic analysis of 3.1 billion emails establishes the baseline email-threat context (1 in 3 malicious/spam, 48% phishing, 90% of high-volume campaigns using phishing-as-a-service kits) later cited in the text-salting report.
- Barracuda begins observing an escalation in text-salting phishing attacks abusing CSS-based hidden text to target AI email security filters.
- Barracuda publishes broader 2026 Email Threats Report findings on AI- and phishing-as-a-service-driven email attack growth, providing volume/context data for the wider campaign landscape.
- Barracuda's Red Team Report documents a related simulated AI-powered attack chain (AI-generated SharePoint-impersonation phishing, ClickFix clipboard hijacking, Evilginx adversary-in-the-middle MFA bypass, WMI/scheduled-task/registry persistence) completing compromise in 5 minutes, illustrating the same 2026 AI-attacker-tradecraft trend text salting belongs to.
- Barracuda publishes a Red Team Report on AI-powered email attacks covering phishing, ClickFix, and MFA-bypass techniques, part of the same 2026 research cadence.
- TL-Intel-Harness HUNT phase ingests the DarkReading article from the RSS backlog and creates threat skeleton TL-2026-1426.
- DarkReading covers the Barracuda research, amplifying visibility of the text-salting technique to the broader security community.
- Barracuda publishes 'Text salting: How hidden text evades AI email security,' disclosing the technique, its CSS/font mechanics, and reporting over one million observed phishing attacks using it since April 2026.
Sources cited for Text-Salting Phishing Campaigns Abuse CSS-Hidden Text to
- Text salting: How hidden text evades AI email security
- 1M Emails Hidden Text Dupe AI Security Filters
- How AI and phishing-as-a-service are changing the email threat landscape
- AI and Phishing-as-a-Service Drive Increase in Email Attacks, Barracuda Reports
- AI-powered email attacks: Red Team Report on phishing, clickFix & MFA bypass
- LLM Prompt Obfuscation (AML.T0068)
- LLM Prompt Injection (AML.T0051)
Threats related to Text-Salting Phishing Campaigns Abuse CSS-Hidden Text to
Detection coverage for TL-2026-1426
As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1426 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.