What are the signs that email text salting is being used in a campaign?

Look for a short visible lure, a much larger hidden HTML block, and CSS that makes the text disappear with display:none, opacity:0, font-size:0, or off-screen placement. A strong clue is when the hidden text is foreign to the visible message and contains no user-facing purpose.

How to recognise email text salting in a campaign

The clearest signs are a short visible lure paired with a much larger hidden HTML block, especially when the hidden content is unrelated to the message the recipient can actually see. Review the rendered email and its source together, because salting often depends on CSS or inline HTML that hides text from users but not from scanners or filters.

Look for concealment techniques such as display:none, opacity:0, font-size:0, white-on-white text, or content pushed off-screen with positioning or negative offsets. The pattern becomes more suspicious when the hidden text reads like a separate payload, keyword block, or foreign-language insert rather than supporting the visible message.

A practical way to judge it is whether the hidden material has any legitimate user-facing purpose. If it does not change the meaning of the email for the recipient, but appears designed to influence detection, classification, or ranking systems, that is a strong indicator of salting rather than normal formatting.

Why salting is used and what it changes for defenders

Text salting is typically used to alter how automated systems interpret an email without changing what the recipient sees. That can help a campaign evade spam scoring, trigger keyword-based filters, or create noisy message variants that are harder to cluster. The abuse is in the mismatch between visible intent and hidden machine-readable content.

Defenders should treat unusual HTML structure as part of the signal, not just the words in the visible body. A message with modest visible content but an outsized HTML source, unusual styling, or repeated hidden phrases deserves closer inspection than a plain-text lure with no obfuscation. The more the hidden block diverges from the user-facing text, the more likely it is being used to shape automated treatment.

It also matters whether the salting appears consistently across a campaign. One odd email may be a formatting mistake, but repeated use of the same concealment pattern across multiple messages points to intentional tradecraft. That makes it useful for detection engineering, because the structural pattern can be more stable than the exact lure text.

What to examine in the raw message and campaign view

Start with the full MIME body, HTML source, and any sanitised preview the mail system stores. The objective is to compare what the user sees with what the message actually contains. Hidden sections, nested spans, tiny fonts, or empty-looking blocks can be missed if you only review the rendered email.

Then compare message variants in the same campaign. If the visible lure changes only slightly but the hidden body changes more aggressively, that can indicate the sender is tuning the salting content to stay ahead of controls. Also check whether the same hidden text appears across many recipients, because that often signals templated abuse rather than an isolated formatting issue.

When you want a broader defensive view of how these patterns fit into messaging abuse and detection, the NIST Cybersecurity Framework 2.0 is a useful organising reference for detection and response work, even though it does not describe salting itself. For message-level control and monitoring practices, NIST SP 800-53 Rev 5 Security and Privacy Controls provides the most relevant control-language for logging, monitoring, and security assessment.

Risk and Threat Considerations

Email text salting is risky because it exploits the gap between human review and automated analysis. The same message can look harmless to a recipient while carrying extra machine-visible content that helps the campaign evade spam, phishing, or classification controls.

Failure mechanism: The attacker hides substantial text in the HTML layer using CSS or layout tricks, so the delivery path evaluates a materially different message than the end user does.

Impact: Filtering accuracy drops, campaign clustering becomes harder, and malicious mail can reach more inboxes or survive longer before detection.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	DE.CM-01 — Networks and systems are monitored to detect cybersecurity events	Hidden HTML salting changes how mail is observed and detected.
Recommendation — Monitor message content anomalies and alert on hidden-text patterns.
NIST SP 800-53 Rev 5	AU-6 — Audit Record Review, Analysis, and Reporting	Campaign salting is best caught through review of message artifacts and anomalies.
	SI-4 — System Monitoring	Salting is an evasive content pattern that warrants active monitoring controls.
Recommendation — Review message telemetry and investigate concealed-content indicators. Apply monitoring rules for suspicious HTML and concealment techniques.

Practitioner Guidance

What to verify: Confirm that the hidden content is actually invisible in common clients, not just in one renderer. A message may expose the salting only in source view, so compare the raw HTML with the rendered output before deciding whether the pattern is deliberate.

What to prioritise: Build detections around structural mismatches, not just keywords. Large hidden blocks, repeated concealed phrases, and extreme HTML-to-visible-text ratios are often better indicators than any single lure phrase.

Practitioner takeaway: Treat salting as a message-integrity problem as much as a phishing problem, because the most useful signal is the mismatch between what the recipient sees and what the filter actually processes.