Text-Salting Phish Bypasses AI Email Filters

How the attack worked

Barracuda identified more than one million retail-themed phishing emails since April built around a technique called text salting. Recipients see a normal-looking urgent message, often claiming that rewards points, loyalty benefits, or a gift card are about to expire and encouraging immediate action. Behind that visible lure, the email's HTML/CSS contains large blocks of unrelated, benign-looking text that is hidden from the reader but present in the underlying code.

A related variant uses a technique called Zero Font, which inserts random hidden words directly inside a recognizable phishing phrase and sets the inserted text to a font size of zero. For example, the underlying HTML may read "Your pass [hidden text] word expired," while the recipient only sees "Your password expired." The campaign also relies on trusted infrastructure, authenticated domains, hidden HTML content, and CSS concealment techniques to improve delivery and reduce suspicion.

Why it succeeded

These emails work because the two layers of content serve different purposes. The visible layer is a simple, believable, urgent lure tied to something many people actually have, like rewards points or a gift card. The hidden layer is designed purely to manipulate how automated detection engines classify the message. Because some security tools scan the raw HTML or source code rather than what the user actually sees, the extra hidden text or invisible inserted words can throw off pattern-matching and signature-based detection, letting messages that would otherwise be flagged slip through to the inbox. Authenticated-looking sending infrastructure, including DKIM configured on lookalike or compromised domains, adds another layer of apparent legitimacy.

What to watch for

• Urgent emails about expiring rewards points, loyalty benefits, or gift cards, especially when unrelated to a recent purchase or account activity
• Generic password-expired notices that are not tied to specific account context
• Links that may not lead to the retailer's or service's real domain, even when the email itself looks legitimate
• Any unusual formatting or hidden HTML artifacts if you inspect a suspicious message's source

Building resistance

Employees, especially in customer support and sales roles that regularly handle retail-related email, should verify urgent expiration claims through a separate, trusted channel, such as typing the retailer's URL directly rather than clicking an embedded link. For password-reset or login requests, use a known bookmark or official portal instead of following a link in the email. Security and IT/identity teams should ensure email defenses analyze the message as it actually renders for the recipient, not just the raw HTML or source code, since that is where hidden content like text salting and Zero Font is designed to operate undetected.

What is text salting in phishing emails?

Text salting is a technique where attackers hide large blocks of harmless-looking text inside a phishing email's HTML/CSS to change how automated detection tools score the message, while the visible message the user sees stays the same.

What is Zero Font in phishing emails?

Zero Font is a technique that embeds random hidden words inside recognizable phishing phrases and sets that inserted text to a font size of zero, so it is invisible to the recipient but can confuse signature-based detection scanning the raw HTML.

How many phishing emails used this technique?

Barracuda identified more than one million retail-themed phishing emails since April that used text salting.

How can I spot this kind of phishing attack?

Treat urgent messages about expiring rewards points, loyalty benefits, or gift cards as suspicious, and verify password-reset or login requests through a known bookmark or official portal rather than an embedded link.