Cybercriminals are successfully bypassing AI spam filters by reviving text salting, a technique dating back to the early 2000s. Security analysts from Barracuda have identified this resurgence, revealing that attackers are exploiting vulnerabilities in machine learning and large language model-based email protection systems to deliver phishing campaigns at scale.
How Are Attackers Using Text Salting?
Since April 2026, researchers have detected over one million phishing emails disguised as communications from retail stores and other commercial entities. These attacks incorporate text salting, a method that involves intentionally inserting random, neutral words into email content to confuse automated analysis systems. The malicious content remains visible to recipients, while the additional text is hidden using HTML and CSS techniques.
According to Barracuda’s research, attackers primarily employ three variations of this technique. The first method uses CSS to crop the display area, ensuring hidden text falls outside the visible portion of the email. The second approach moves neutral words beyond the screen boundaries. The third variant applies zero font size and embeds textual noise between suspicious phrases. Human recipients see only the phishing bait as intended by attackers, while automated analyzers process a mixture of malicious content and random words, making messages appear less suspicious or completely incoherent to AI systems.
Why Are AI Systems Vulnerable?
Traditional email security solutions generally succeed in recognizing these tricks by removing hidden elements, comparing HTML code with displayed content, and flagging large amounts of invisible text. However, some AI-powered tools have proven vulnerable to methods spammers used decades ago. The core issue lies in how large language models process email data.
Barracuda specialists explain that LLMs often treat the email’s text and source code as a single data sequence. These models do not always distinguish between elements actually visible to users and those hidden through styling or positioned off-screen. Researchers note that text salting and related techniques allow attackers to confuse AI content analysis engines, as the stream of random terms pushes systems toward incorrect message classification.
What Solutions Do Researchers Recommend?
While AI models could theoretically be trained to account for HTML rendering characteristics, many protective solutions apparently do not implement this by default. Security experts recommend against evaluating emails solely based on text content or AI classifier verdicts. Comprehensive email protection should verify sender reputation, authentication results, embedded URLs, HTML rendering peculiarities, and differences between visible and hidden message content.
Source: Xakep