# Over 1 Million Phishing Emails Exploiting Hidden Text Technique to Bypass AI-Powered Security Filters


Barracuda researchers expose text salting as surprisingly effective against modern AI-based email security, as attackers leverage LLMs to rapidly scale social engineering campaigns


A deceptively simple text manipulation technique is proving far more effective against today's advanced email security systems than many defenders realize. Since April 2026, researchers at Barracuda Networks have tracked more than 1 million phishing emails using hidden text "salting" to evade both traditional rules-based and artificial intelligence-powered email security filters—demonstrating a critical blind spot in how modern security engines evaluate email content.


The campaign, which primarily targets retail customers with promises of rewards, gift cards, and urgent offers, represents a troubling trend: attackers are weaponizing large language models (LLMs) to generate salted phishing emails at scale, while the AI-based detection systems meant to stop them struggle to adapt.


## The Threat: A Million-Email Campaign Hiding in Plain Sight


The phishing emails Barracuda researchers observed display all the hallmarks of low-effort spam: crude brand impersonation, generic social engineering hooks, and obvious urgency tactics. Yet despite their lack of sophistication in design, these emails are reaching inboxes at unprecedented scale—bypassing sophisticated email gateway defenses that organizations have invested heavily in deploying.


Key characteristics of the observed campaign:


  • Volume: Over 1 million retail-themed phishing emails since April 2026
  • Technique: Hidden text salting to confuse content analysis engines
  • Targets: Retail customers lured by gift card offers and rewards programs
  • Authentication: Proper use of DKIM and other standards, making emails appear legitimate
  • Sender sources: Mix of brand-lookalike domains and compromised legitimate websites

  • According to Peterson Gutierrez, vice president of information security at Barracuda, the persistence and growth of text salting campaigns reveals a fundamental vulnerability in how modern security systems evaluate email content. "A technique many people associate with older spam-filter evasion can also influence modern AI-based detection," Gutierrez noted—a finding that contradicts assumptions that sophisticated AI defenses have rendered legacy evasion techniques obsolete.


    ## Background and Context: Text Salting and the Evolution of Email Evasion


    Text salting—the practice of inserting hidden, non-visible text into emails to manipulate security filters—is far from new. The technique has been used in spam and phishing campaigns for decades, predating widespread AI adoption in security systems. Security analysts long assumed that modern machine learning-based email gateways would render such simplistic tricks ineffective.


    The current campaign demonstrates the opposite: text salting is not only surviving the transition to AI-driven security, it's thriving because of it.


    Why the technique remains effective:


  • Hidden text bypasses visual inspection: Text rendered in white-on-white, off-canvas, or through CSS tricks is invisible to human reviewers but can influence AI model analysis
  • Asymmetric advantage for attackers: LLMs like GPT-4 enable attackers to rapidly generate variations of salted text at scale, far faster than security teams can develop countermeasures
  • AI training blindspots: Many AI security models are trained primarily on malicious emails *as they appear to users*, not on the raw underlying text that includes hidden salting
  • Legitimate use cases complicate detection: Some legitimate email marketing employs hidden metadata or tracking pixels, making it harder to distinguish malicious from benign hidden text

  • The irony is stark: the very AI systems deployed to defend organizations against sophisticated threats are being circumvented by a technique so old it predates the spam era, now weaponized through generative AI to scale faster than ever before.


    ## Technical Details: How the Attack Works


    ### Secure Email Gateways and Their Limitations


    Secure email gateways (SEGs) operate as security checkpoints, using rules and machine learning models to decide whether emails should reach users' inboxes. The evaluation process occurs at two levels:


    Static authentication checks verify sender legitimacy:

  • DomainKeys Identified Mail (DKIM) authentication
  • SPF (Sender Policy Framework) records
  • DMARC (Domain-based Message Authentication, Reporting and Conformance) policies

  • Barracuda's observations show that many phishing emails in the campaign pass these checks—either because they originate from compromised legitimate domains with valid authentication, or because attackers are spoofing carefully constructed lookalike domains that pass basic validation.


    Content analysis and AI filtering examines email body text, links, and sender behavior. This is where text salting becomes weaponized. Attackers embed invisible text designed to:

  • Include benign keywords that trick AI models into rating the email as low-risk
  • Dilute or obscure malicious indicators by padding the email with innocuous content
  • Exploit the gap between how AI models analyze raw text versus how humans perceive the email's visual presentation

  • ### The Role of LLMs in Scaling the Attack


    What distinguishes this campaign from earlier text salting attempts is velocity and variation. Barracuda researchers noted that attackers are using LLMs to generate large volumes of personalized, salted phishing emails—each with unique hidden text variations that make signature-based detection nearly impossible.


    An attacker might use a prompt like: *"Generate 100 variations of a gift card phishing email with hidden text that discusses loyalty rewards, holiday sales, and customer benefits. Include these keywords naturally throughout hidden sections: legitimate, verified, official, trusted."* The LLM obliges, producing thousands of unique emails that preserve the malicious core while varying the surface-level content AI models analyze.


    ## Implications for Organizations and Defenders


    The scale and sophistication of this campaign raises uncomfortable questions about the state of email security in 2026:


    For Security Teams:

  • Existing AI defenses may be overestimated: Organizations relying primarily on AI-powered email gateways may face a false sense of security
  • Detection gaps are widening: As attackers scale salting techniques via LLMs, the volume of variations outpaces the ability of static and even adaptive AI models to keep up
  • Breach likelihood is rising: Over 1 million phishing emails reaching inboxes means successful infections are likely occurring at scale, even if click-through and compromise rates remain proportionally low

  • For End Users:

  • Phishing remains the leading attack vector: Despite sophisticated defenses, user inboxes are flooded with credible-looking malicious emails
  • Visual inspection alone is insufficient: Emails that look crude or low-effort may still represent genuine threats that bypassed multiple security layers

  • For Email Service Providers and Vendors:

  • Architectural rethinking is urgent: Current approaches to AI-based content analysis may need fundamental revision to account for hidden-text evasion
  • Adversarial robustness is missing: Email security systems are not being tested against text salting techniques, leaving them vulnerable to known but unpatched attack patterns

  • ## Recommendations for Defenders


    ### Immediate Actions


    1. Audit email gateway configurations: Review whether your SEG includes specific detection rules for hidden text (CSS-based opacity, zero-size elements, off-canvas text, color-matching techniques). Many default configurations do not.


    2. Enable stricter authentication policies: Implement DMARC in "reject" mode, not just "quarantine." Reject emails that fail SPF/DKIM/DMARC checks rather than allowing them through for additional analysis.


    3. Deploy supplementary user training: Since email filters are clearly insufficient, employee security awareness training focused on phishing recognition remains critical. Emphasize that legitimate companies rarely send unsolicited gift card or reward offers.


    4. Monitor email gateway logs: Look for patterns of emails from the same sender domain that are failing content analysis but passing authentication checks—a red flag for compromised legitimate domains.


    ### Long-Term Strategy


  • Advocate for vendor improvements: Contact your email security vendor and demand explicit support for detecting hidden-text evasion techniques. If they can't articulate their defenses against text salting, consider alternatives.

  • Invest in behavioral email authentication: Look beyond content filtering to sender behavior analysis—flagging sudden spikes in outbound emails from a domain, unusual recipient patterns, or authentication anomalies.

  • Implement user-reported phishing workflows: Create low-friction reporting mechanisms that allow employees to flag suspicious emails. Attackers' scale advantage depends on users not catching what filters miss.

  • ---


    ## HackWire Analysis


    This campaign exposes a critical vulnerability in how we've architected modern email security: we've outsourced trust to AI systems that are themselves being outmaneuvered by adversaries using AI to generate evasion techniques. The 1 million email milestone isn't notable because it's the largest phishing campaign ever—it's notable because *this simple technique is still working despite a decade of AI-powered defense deployments*.


    The real story here isn't the hidden text itself; it's the asymmetry. Attackers use LLMs to generate 1 million variations of salted emails in hours. Defenders use AI to catch the patterns those variations create—but each variation, by design, breaks previous patterns. This is an arms race where the attacker's tool (an LLM that generates infinite variations) is fundamentally faster than the defender's tool (an AI model that learns from finite training data and cannot retrain in real-time).


    What should worry defenders most: if a decades-old technique this obvious is still beating modern AI filters at scale, what other "solved" attack categories might be experiencing quiet resurgences? The hidden-text technique works because email gateways analyze text differently than humans do, and attackers found the gap. That same gap likely exists elsewhere in the security stack—in how AI evaluates images, metadata, behavioral signals, or other content types. Organizations that assume AI-based defenses have "solved" a problem category are likely to be surprised.


    For practitioners, this is a call to rebuild verification mechanisms that don't depend on filter sophistication. DMARC enforcement, behavioral baselines, and human reporting loops aren't cutting-edge—they're the reliable parts of the system that AI supplements, not replaces.


    — *HackWire Editorial*


    ## Related Coverage


  • Read more in our [Phishing & Social Engineering](https://www.hackwire.news/category/social-engineering) coverage
  • Cross-reference with [Email Security](https://www.hackwire.news/category/email-security) and [AI Security Threats](https://www.hackwire.news/category/ai-security)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)