# Over 1 Million Phishing Emails Exploiting Hidden Text Technique to Bypass AI-Powered Security Filters
Barracuda researchers expose text salting as surprisingly effective against modern AI-based email security, as attackers leverage LLMs to rapidly scale social engineering campaigns
A deceptively simple text manipulation technique is proving far more effective against today's advanced email security systems than many defenders realize. Since April 2026, researchers at Barracuda Networks have tracked more than 1 million phishing emails using hidden text "salting" to evade both traditional rules-based and artificial intelligence-powered email security filters—demonstrating a critical blind spot in how modern security engines evaluate email content.
The campaign, which primarily targets retail customers with promises of rewards, gift cards, and urgent offers, represents a troubling trend: attackers are weaponizing large language models (LLMs) to generate salted phishing emails at scale, while the AI-based detection systems meant to stop them struggle to adapt.
## The Threat: A Million-Email Campaign Hiding in Plain Sight
The phishing emails Barracuda researchers observed display all the hallmarks of low-effort spam: crude brand impersonation, generic social engineering hooks, and obvious urgency tactics. Yet despite their lack of sophistication in design, these emails are reaching inboxes at unprecedented scale—bypassing sophisticated email gateway defenses that organizations have invested heavily in deploying.
Key characteristics of the observed campaign:
According to Peterson Gutierrez, vice president of information security at Barracuda, the persistence and growth of text salting campaigns reveals a fundamental vulnerability in how modern security systems evaluate email content. "A technique many people associate with older spam-filter evasion can also influence modern AI-based detection," Gutierrez noted—a finding that contradicts assumptions that sophisticated AI defenses have rendered legacy evasion techniques obsolete.
## Background and Context: Text Salting and the Evolution of Email Evasion
Text salting—the practice of inserting hidden, non-visible text into emails to manipulate security filters—is far from new. The technique has been used in spam and phishing campaigns for decades, predating widespread AI adoption in security systems. Security analysts long assumed that modern machine learning-based email gateways would render such simplistic tricks ineffective.
The current campaign demonstrates the opposite: text salting is not only surviving the transition to AI-driven security, it's thriving because of it.
Why the technique remains effective:
The irony is stark: the very AI systems deployed to defend organizations against sophisticated threats are being circumvented by a technique so old it predates the spam era, now weaponized through generative AI to scale faster than ever before.
## Technical Details: How the Attack Works
### Secure Email Gateways and Their Limitations
Secure email gateways (SEGs) operate as security checkpoints, using rules and machine learning models to decide whether emails should reach users' inboxes. The evaluation process occurs at two levels:
Static authentication checks verify sender legitimacy:
Barracuda's observations show that many phishing emails in the campaign pass these checks—either because they originate from compromised legitimate domains with valid authentication, or because attackers are spoofing carefully constructed lookalike domains that pass basic validation.
Content analysis and AI filtering examines email body text, links, and sender behavior. This is where text salting becomes weaponized. Attackers embed invisible text designed to:
### The Role of LLMs in Scaling the Attack
What distinguishes this campaign from earlier text salting attempts is velocity and variation. Barracuda researchers noted that attackers are using LLMs to generate large volumes of personalized, salted phishing emails—each with unique hidden text variations that make signature-based detection nearly impossible.
An attacker might use a prompt like: *"Generate 100 variations of a gift card phishing email with hidden text that discusses loyalty rewards, holiday sales, and customer benefits. Include these keywords naturally throughout hidden sections: legitimate, verified, official, trusted."* The LLM obliges, producing thousands of unique emails that preserve the malicious core while varying the surface-level content AI models analyze.
## Implications for Organizations and Defenders
The scale and sophistication of this campaign raises uncomfortable questions about the state of email security in 2026:
For Security Teams:
For End Users:
For Email Service Providers and Vendors:
## Recommendations for Defenders
### Immediate Actions
1. Audit email gateway configurations: Review whether your SEG includes specific detection rules for hidden text (CSS-based opacity, zero-size elements, off-canvas text, color-matching techniques). Many default configurations do not.
2. Enable stricter authentication policies: Implement DMARC in "reject" mode, not just "quarantine." Reject emails that fail SPF/DKIM/DMARC checks rather than allowing them through for additional analysis.
3. Deploy supplementary user training: Since email filters are clearly insufficient, employee security awareness training focused on phishing recognition remains critical. Emphasize that legitimate companies rarely send unsolicited gift card or reward offers.
4. Monitor email gateway logs: Look for patterns of emails from the same sender domain that are failing content analysis but passing authentication checks—a red flag for compromised legitimate domains.
### Long-Term Strategy
---
## HackWire Analysis
This campaign exposes a critical vulnerability in how we've architected modern email security: we've outsourced trust to AI systems that are themselves being outmaneuvered by adversaries using AI to generate evasion techniques. The 1 million email milestone isn't notable because it's the largest phishing campaign ever—it's notable because *this simple technique is still working despite a decade of AI-powered defense deployments*.
The real story here isn't the hidden text itself; it's the asymmetry. Attackers use LLMs to generate 1 million variations of salted emails in hours. Defenders use AI to catch the patterns those variations create—but each variation, by design, breaks previous patterns. This is an arms race where the attacker's tool (an LLM that generates infinite variations) is fundamentally faster than the defender's tool (an AI model that learns from finite training data and cannot retrain in real-time).
What should worry defenders most: if a decades-old technique this obvious is still beating modern AI filters at scale, what other "solved" attack categories might be experiencing quiet resurgences? The hidden-text technique works because email gateways analyze text differently than humans do, and attackers found the gap. That same gap likely exists elsewhere in the security stack—in how AI evaluates images, metadata, behavioral signals, or other content types. Organizations that assume AI-based defenses have "solved" a problem category are likely to be surprised.
For practitioners, this is a call to rebuild verification mechanisms that don't depend on filter sophistication. DMARC enforcement, behavioral baselines, and human reporting loops aren't cutting-edge—they're the reliable parts of the system that AI supplements, not replaces.
— *HackWire Editorial*
## Related Coverage