# Text-Salting Phishing Campaigns Abuse CSS-Hidden Text to Evade AI Email Security Filters

> Barracuda researchers have detected over one million phishing attacks since April 2026 using a technique dubbed 'text salting' — CSS tricks and zero-point font injection hide large volumes of benign, high-reputation text inside emails so AI/LLM-based email security filters misclassify the message as legitimate, while the recipient sees only the malicious phishing content.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1426
- **ID:** TL-2026-1426
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Barracuda's threat research team has identified an escalating adversarial-content technique against AI-powered email security filters, which the vendor calls 'text salting.' The technique conceals large amounts of innocuous, high-reputation-sounding text — cloned brand newsletter copy, fiction/story content, generic conversational or project-style notes — inside the raw HTML/DOM of a phishing email using CSS and font rendering tricks, so that the text is never visible to the human recipient but is fully present in the source code that AI/LLM-based classifiers, sentiment analyzers, and keyword/ML detectors ingest.

The core insight exploited is architectural: large language models and other AI content classifiers used in modern email security stacks process raw source text/HTML rather than rendered visual output, and cannot inherently distinguish 'content a human will see' from 'content injected purely to manipulate the model.' By diluting the concentration of suspicious keywords (rewards, expires, card, password) with high counts of benign, unrelated terms (puppy, training, notes, task, rhythm, book) and coherent-sounding filler paragraphs generated cheaply at scale with generative AI, attackers shift the model's sentiment, intent, and risk classification toward 'legitimate,' allowing the phishing payload to reach the inbox.

Observed concealment mechanics fall into three families: (1) viewport/box cropping — `clip-path: inset(100%)`, `max-height:0` combined with `line-height:0` to collapse vertical space without leaving a rendering gap; (2) off-screen displacement — `text-indent:-9999px` pushing text thousands of pixels outside the visible canvas combined with `overflow:hidden` to suppress the resulting scrollbar; and (3) font manipulation — zero/near-zero `font-size` injection of disruptive or randomized tokens directly inside legitimate sentences (e.g. 'Your pass[random]word expired') to break up signature/keyword-based detection strings while remaining invisible to the reader.

Barracuda reports more than one million phishing attacks using this technique since April 2026, predominantly retail-themed lures (urgent rewards/points expiration, gift-card redemption offers) impersonating well-known brands, with attackers pairing the hidden-text payload with compromised legitimate sending domains or convincing lookalike domains configured with valid DKIM signing to additionally defeat traditional authentication-based email security controls. The vendor situates this inside a broader 2026 trend of AI/phishing-as-a-service driven email threats: Barracuda's wider research shows phishing constitutes roughly 48% of malicious email activity, roughly 1 in 3 of 3.1 billion emails analyzed in January 2026 were malicious/spam, and 90% of high-volume phishing campaigns now use phishing-as-a-service kits, all of which lower the cost of producing large volumes of AI-generated filler content needed to run a text-salting campaign at scale.

This is a filter/model-evasion technique rather than a software vulnerability — there is no CVE. It is conceptually adjacent to MITRE ATLAS AML.T0068 (LLM Prompt Obfuscation, under the Defense Evasion tactic), which documents adversaries hiding or obfuscating injected content from LLM-based guardrails using near-identical mechanisms (small/zero font size, background-matched text color, hidden HTML elements) to evade detection by AI systems, and to indirect prompt injection (AML.T0051), where an LLM-based classifier ingests attacker-controlled hidden content embedded in an email/document it is asked to evaluate. Currently text-salted messages represent under 1% of observed email traffic per Barracuda, but the vendor flags the technique as an early, fast-growing signal of attacker tradecraft purpose-built to target AI-based (rather than purely rule-based) email security products.

## MITRE ATT&CK

- T1586 Compromise Accounts
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1566 Phishing
- T1027 Obfuscated Files or Information
- T1684.001 Impersonation
- T1036 Masquerading
- AML.T0068 LLM Prompt Obfuscation
- AML.T0051 LLM Prompt Injection
- T1114 Email Collection
- T1539 Steal Web Session Cookie
- T1056 Input Capture
- T1657 Financial Theft
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1546 Event Triggered Execution
- T1053 Scheduled Task/Job
- T1547 Boot or Logon Autostart Execution
- T1098 Account Manipulation
- T1557 Adversary-in-the-Middle
- T1685 Disable or Modify Tools
- T1105 Ingress Tool Transfer

## Sources

- [Text salting: How hidden text evades AI email security](https://blog.barracuda.com/2026/07/16/text-salting-ai-email-security)
- [1M Emails Hidden Text Dupe AI Security Filters](https://www.darkreading.com/threat-intelligence/1m-emails-hidden-text-dupe-ai-security-filters)
- [How AI and phishing-as-a-service are changing the email threat landscape](https://blog.barracuda.com/2026/05/12/ai-phishing-service-changing-email-threat-landscape)
- [AI and Phishing-as-a-Service Drive Increase in Email Attacks, Barracuda Reports](https://www.businesswire.com/news/home/20260512729215/en/AI-and-Phishing-as-a-Service-Drive-Increase-in-Email-Attacks-Barracuda-Reports)
- [AI-powered email attacks: Red Team Report on phishing, clickFix & MFA bypass](https://blog.barracuda.com/2026/06/17/red-team-report-ai-powered-email-attacks)
- [LLM Prompt Obfuscation (AML.T0068)](https://www.startupdefense.io/mitre-atlas-techniques/aml-t0068-llm-prompt-obfuscation-5ac63)
- [LLM Prompt Injection (AML.T0051)](https://www.startupdefense.io/mitre-atlas-techniques/aml-t0051-llm-prompt-injection)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1426