Email Salting Attacks: How Hidden Text Can Bypass Email Security Filters

What Email Salting Attacks Are and Why They Matter

Email salting attacks are evasive email threats that insert irrelevant, invisible, or misleading content into a message to confuse spam filters, Secure Email Gateway tools, and AI-powered email security systems. This tactic, often called text salting, changes how the message appears to scanners while keeping the visible message persuasive to the recipient.

In practical terms, email salting attacks allow malicious emails to look benign during automated content analysis. A Phishing Email may visually ask a user to “verify your Wells Fargo account,” but the underlying HTML may include hidden text filled with neutral language, brand names, random words insertion, or unrelated phrases designed to dilute suspicious signals.

Why attackers use text salting

Attackers use text salting because many spam filters still evaluate message bodies for keywords, phrase patterns, reputation signals, and statistical indicators. A Bayesian spam filter, for example, may assign lower risk if the email contains enough benign terms. This is where Bayesian poisoning becomes dangerous: attackers intentionally pollute the text model with harmless-looking language to make phishing attacks appear less suspicious. Email salting attacks also matter because they are increasingly paired with generative AI, social engineering attacks, domain impersonation, and business email compromise. Criminals can use Generative AI to produce natural-looking benign text injection at scale, making phishing attacks harder for traditional tools and even some LLM-based security tools to classify correctly.

For organizations, improving email security means recognizing that visible content is only part of the threat. Hidden text, hidden Unicode characters, CSS concealment, and email header salting can all alter what security tools see versus what users see.

How Hidden Text Manipulates Email Content Analysis

Hidden text manipulates content analysis by creating two versions of the same email: one for the victim and another for the scanner. The recipient sees a clean call to action, such as “open invoice,” “reset password,” or “approve payment,” while spam filters and email gateways process additional hidden text that may be invisible in the rendered message.

The scanner-recipient mismatch

This mismatch is central to email salting attacks. In HTML email, attackers can place invisible text behind visible content, hide it with CSS, or insert hidden Unicode characters between letters. To a user, the message may appear to be a legitimate notification from a trusted company, financial institution, or internal department.

AI-powered email security systems perform deeper content analysis, but they can still be challenged when text salting introduces content inconsistencies at scale. Some systems may summarize or tokenize the body in ways that overlook suspicious formatting. Others may be affected by Bayesian poisoning if malicious emails include enough benign filler to weaken known phishing indicators.

How Bayesian poisoning changes risk scoring

Bayesian poisoning works by manipulating probability-based classification. If a Bayesian spam filter has learned that certain words commonly appear in legitimate mail, attackers may add those terms as hidden text. Over time, or in a single message, this can reduce the apparent probability that the message is malicious.

This does not mean Bayesian poisoning defeats every control. Strong AI-powered email security, advanced threat intelligence, sender reputation analysis, email authentication, DKIM, DMARC, and SMTP header validation all help. However, Bayesian poisoning remains effective when organizations rely too heavily on body-text scanning or legacy spam filters.

Common Techniques Used in Email Salting Campaigns

Email salting campaigns rely on HTML, CSS, Unicode, and header manipulation. The goal is always the same: change what detection tools analyze without changing what the human target sees.

Hidden Unicode characters and invisible characters

One of the most common techniques involves hidden Unicode characters, invisible characters, and zero-width character insertion. Attackers may place a zero-width character between letters in words such as “password,” “invoice,” or “login,” preventing exact-match detection. Hidden Unicode characters can also be used to break malicious phrases while preserving visual readability.

Unicode homoglyph attacks are related. In these attacks, a character that looks like a Latin letter is replaced with a similar-looking Unicode character. This can help domain impersonation, brand spoofing, and phishing attacks evade Industry-Standard Detection Tools.

CSS concealment and HTML-rendering techniques

CSS concealment is another major component of text salting. Attackers use HTML-rendering techniques to hide large volumes of text from the user while leaving it present in the message source. Common examples include font-size:0, display:none, font color white, overflow:hidden, and text-indent:-9999px.

Examples of CSS hiding methods

A phishing message might include a block of hidden text styled with display:none, or it may use a zero font technique through font-size:0. Another campaign may render invisible text in font color white on a white background. More advanced CSS concealment may combine overflow:hidden with layout tricks so that only benign-looking visible content appears.

Why source code inspection matters

Source code inspection is often the fastest way to reveal hidden text, CSS concealment, suspicious formatting, and content inconsistencies. Security analysts performing Forensic Analysis can inspect HTML, CSS, and MIME structure to determine whether text salting was used in the attack flow.

Email header salting and routing manipulation

Email salting attacks are not limited to the body. Email header salting may involve manipulating non-visible fields, adding misleading comments, or exploiting inconsistencies in Return-path and Reply-to values. Reply-to manipulation and return-path manipulation can redirect responses to attacker-controlled accounts even when the visible From field appears legitimate.

Security teams can use email security and authentication tools to identify abnormal headers, DKIM failures, DMARC misalignment, and sender reputation anomalies. However, hidden text and header manipulation are often used together to increase the chances of bypassing spam filters.

Business Risks: Phishing, Malware Delivery, and Brand Impersonation

The business impact of email salting attacks is significant because these campaigns are designed to make malicious emails appear routine. SMBs, MSPs, and Financial Services firms are common targets because they handle payments, credentials, and Sensitive Information.

Phishing attacks and credential theft

Many phishing attacks that use text salting are credential-harvesting attempts. A user may receive a fake Microsoft 365 alert, Wells Fargo notification, Norton LifeLock renewal notice, or internal HR message. The visible call to action leads to compromised websites or counterfeit login portals, while hidden text helps the email evade spam filters.

Business email compromise is especially dangerous when email salting attacks are paired with reply-to manipulation. The visible message may appear to come from an executive or vendor, while the Reply-to directs responses to an attacker. In these cases, email security teams must analyze both visible content and SMTP metadata.

Malware delivery and malicious payload staging

Text salting also supports malware delivery. The message may include a link to a malicious payload hosted on compromised websites, or an attachment disguised as an invoice. Hidden Unicode characters and CSS concealment can break up suspicious phrases such as “enable macros,” “download document,” or “secure payment,” reducing detection by older spam filters.

Modern AI-powered email security can identify behavior patterns, attachment risk, and URL reputation, but attackers continuously adapt. Generative AI enables faster creation of convincing copy, and Machine Learning models must be trained to recognize invisible text, hidden Unicode characters, CSS concealment, and Bayesian poisoning indicators.

Detection and Prevention Strategies for Security Teams

Security teams should treat email salting attacks as an evasion technique, not merely a spam problem. Effective defense requires layered security, user education, authentication controls, and continuous threat analysis.

Strengthen technical detection

Organizations should deploy AI-powered email security that inspects rendered HTML, raw source, headers, URLs, attachments, and sender reputation. A strong Secure Email Gateway or Email Security Gateway should detect CSS concealment, hidden text, hidden Unicode characters, random words insertion, and suspicious formatting.

Security teams should also tune detections for display:none, font-size:0, overflow:hidden, text-indent:-9999px, zero-width character usage, and abnormal Unicode density. LLM-based security tools can help summarize suspicious content, but they should be paired with deterministic checks, Forensic analysis tools, and advanced threat intelligence.

Validate identity and authentication signals

Email authentication remains essential. DKIM, DMARC, SPF, and SMTP-level validation help confirm whether the sending infrastructure is authorized. While email authentication does not directly stop hidden text, it can reduce domain impersonation and help identify spoofed senders. Combining authentication controls with content analysis and threat intelligence provides a more comprehensive approach to detecting and preventing email-based attacks.

Improve response and awareness

Real-time alerts should flag content inconsistencies, invisible text, header anomalies, and unusual Reply-to or Return-path behavior. Analysts should document the full attack flow, including sender infrastructure, malicious payload location, compromised websites, and the role of Bayesian poisoning.

Finally, email threat awareness training should teach employees that clean-looking messages can still be dangerous. Users should be cautious with urgent requests, payment changes, credential prompts, and unexpected attachments. When paired with layered security and AI-powered email security, informed users become a critical defense against email salting attacks, phishing attacks, and text salting campaigns that attempt to bypass spam filters.