As many as 1 million retail-themed phishing emails have been evading both static and artificial intelligence-powered email security checks by using a simple yet effective technique called text salting. This tactic involves peppering spam content with innocuous filler words or stories to break up malicious language, making it harder for automated filters to detect.
The emails in question are designed to look like legitimate messages from retailers, promising rewards, points, and gift cards to targets. However, they employ obvious social engineering tricks, including urgent offers that aim to get people to click on malicious links. Despite their low-effort presentation, these emails have been able to slip through the security nets of email gateways, which use various rules to decide whether to let entrants through.
Email gateways, also known as secure email gateways (SEGs), are designed to protect inboxes from spam and phishing attacks. They check for straightforward signals such as legitimate sender domains and industry-standard authentication protocols. However, the campaigns observed by Barracuda Networks, a cybersecurity firm, have been able to use standard DomainKeys Identified Mail (DKIM) for authentication, making it harder for SEGs to flag them as suspicious.
The challenge lies in interpreting content, which is where artificial intelligence-powered filters come into play. These filters look for malicious or spammy language by filtering for specific phrases and word usage patterns. However, the emails being targeted by hackers use language that appears legitimate to the human eye but remains undetected by AI-powered filters. This is because SEGs don’t see the visual presentation of an email; instead, they see the machine-readable data underneath.
To evade detection, attackers manipulate the HTML code underpinning their emails, peppering spam content with innocuous filler words or stories. This can involve injecting suspicious words like “urgent” or “rewards” with nice words like “puppy” or “book.” The goal is to make it difficult for AI-powered filters to distinguish between legitimate and malicious content.
Text salting has been around for a while, but its continued use shows that it remains an effective tactic. Modern security tools know about text salting and try to un-hide hidden text by looking for HTML or CSS rules that make text invisible to users. However, hackers are layering multiple salting techniques on top of one another, making it harder for filters to detect.
The takeaway from this is that AI-powered email security filters can be surprisingly ineffective against text salting, allowing phishing emails to reach inboxes undetected. To stay ahead of these tactics, it’s essential to maintain a robust cybersecurity posture and regularly update security tools to account for new threats. Additionally, being cautious when receiving unsolicited emails, especially those with urgent offers or promises of rewards, can go a long way in preventing phishing attacks from succeeding.
Source: Dark Reading — 2026-07-16