Executive Summary
Researchers have identified a massive surge in phishing campaigns—exceeding one million attacks since April 2026—leveraging 'text salting' to bypass modern AI-powered email security. This technique involves hiding large blocks of innocuous text (such as stories or random word lists) within the HTML of an email. While invisible to the recipient, this content dilutes the concentration of malicious terms, tricking Large Language Models (LLMs) and machine learning filters into classifying the message as legitimate.
Technically, attackers employ advanced CSS and HTML rendering tricks such as 'zero font' sizes, negative text indentation, and clipping paths to ensure the 'salted' content remains hidden from the human eye. These campaigns often use compromised legitimate domains or lookalike domains configured with standard DKIM authentication to further establish legitimacy. The use of generative AI has significantly lowered the cost and increased the scale of these attacks, allowing for highly varied, unique content for every phishing message.
This trend represents a critical shift in the cat-and-mouse game between attackers and defenders. Traditional keyword filtering and standard AI analysis are proving insufficient when they process raw source code without account for what is actually rendered for the user. Organizations must pivot toward layered security models that analyze message structure, behavioral anomalies, and visual rendering to effectively counter these evasion tactics.