Text salting is becoming an industrial phishing bypass

At a glance

What this is: IRONSCALES shows that phishing campaigns are using hidden HTML text to dilute AI email scores, turning a simple lure into a machine-targeted bypass.

Why it matters: This matters because email security controls that score raw message text can be manipulated by content the user never sees, which weakens detection across phishing, credential theft and fraud campaigns.

By the numbers:

• Hidden-text blocks appeared in about 7% of evasive phishing cases over six months, according to IRONSCALES.
• The technique grew from about 1% in December 2025 to 11% by June 2026, according to IRONSCALES.

Context

Text salting is a phishing evasion technique that hides large blocks of harmless HTML text from people while leaving them visible to machine classifiers. The article’s core problem is the split between rendered email and raw source, which creates a governance gap for security tooling that scores one view while the recipient experiences the other.

For identity and access teams, the relevance is indirect but real: phishing still remains a primary path to credential theft, OAuth abuse, and downstream account compromise. The control issue is not just content inspection, but whether email security can model what the human actually sees and whether security operations can distinguish legitimate hidden text from malicious concealment.

Key questions

Q: What should email security teams do when phishing starts hiding text from classifiers?

A: They should stop relying on a single raw-text score and compare the rendered email with the HTML source. If a message contains bulky hidden prose, hard-hide CSS, and a short visible lure, treat that mismatch as an evasion pattern and route it to deeper inspection before delivery.

Q: Why does hidden text make phishing harder for AI email filters to catch?

A: Because many filters score the full HTML text, while the recipient sees only the rendered message. Attackers can dilute the lure by appending large volumes of benign-looking filler, which lowers the classifier’s confidence even though the visible email remains clearly malicious to a person.

Q: What are the signs that email text salting is being used in a campaign?

A: Look for a short visible lure, a much larger hidden HTML block, and CSS that makes the text disappear with display:none, opacity:0, font-size:0, or off-screen placement. A strong clue is when the hidden text is foreign to the visible message and contains no user-facing purpose.

Q: When does phishing content inspection fail because of cloaking redirects?

A: It fails when scanners and real users are sent to different destinations from the same link. If a crawler sees a benign decoy but a user reaches a credential-harvesting page or fraud funnel, the link analysis layer has been deceived and the email should be treated as hostile.

Technical breakdown

Rendered email versus raw HTML

Modern email security often scores the raw message body, while the user sees only the rendered version. Attackers exploit that mismatch by hiding large blocks of benign prose with CSS techniques such as display:none, opacity:0, font-size:0, or off-screen positioning. The model reads the full text and averages the signal, but the recipient never sees the concealed filler. That is why this is not simply a content problem. It is a visibility problem created by two different interpretations of the same message.

Practical implication: Inspect the rendered view and the source view separately so hidden content can be evaluated as an evasion signal, not just as text.

Why hidden-text dilution lowers model confidence

Language models and classic NLP classifiers both infer threat from the combined semantics of a message. When a short lure is padded with hundreds of words of benign-looking prose, the malicious intent becomes less prominent in the scoring window. The attacker is not trying to make phishing look harmless in a human sense. They are trying to alter the statistical balance of the classifier so the message falls below the action threshold. That makes the attack effective across a wide range of AI-based email filters.

Practical implication: Add controls that penalise bulk concealed prose rather than relying only on content sentiment or keyword scoring.

Cloaking redirects and scanner deception

The campaign pairs hidden text with URL cloaking. A scanner follows the link and receives a decoy destination, while a human clicking from a mailbox is sent to the real malicious page. That creates two independent false signals, one in the body and one in the link path. The combination is important because it shows the attacker is designing for both content inspection and link analysis. In practice, that means the filter sees a benign-looking email and a benign-looking destination, even though the victim experience is entirely different.

Practical implication: Validate link destinations in a way that simulates real user context, not only automated crawler behaviour.

Threat narrative

Attacker objective: To push malicious email past automated detection and route victims to fraud or credential-harvesting infrastructure.

1. Entry occurs through a phishing email that presents a short visible lure while embedding a large hidden block of benign HTML prose.
2. Credential access and fraud follow when the visible link leads victims to reward scams or credential-harvesting pages, while scanners are shown decoy destinations.
3. Impact is a repeatable phishing bypass that can carry credential theft, affiliate fraud, or malware delivery through the same hidden-text wrapper.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Hidden-text evasion is now a production phishing pattern, not a niche trick. The article shows consistent pairing between concealed prose and cloaking redirects, which is exactly what toolchain-generated abuse looks like. That matters because security teams often treat evasion as an exception, when in reality the adversary has standardised it. Practitioners should assume the bypass is repeatable, not opportunistic.

Text salting exposes a detection gap between what the machine reads and what the user experiences. The control failure is not weak phishing awareness alone, but reliance on a single raw-text scoring view. That gap is especially relevant where phishing is the front end to human identity compromise, OAuth abuse, or NHI credential theft. Teams need governance over the rendered message, not just the source code.

Concealed-content abuse creates a new named concept: rendered-message trust gap. This is the gap between the email representation used by security tooling and the email representation available to the recipient. Once attackers can reliably widen that gap, content-based scoring becomes easier to steer. The practitioner conclusion is that email security architecture must treat visibility as a control surface, not a formatting detail.

The important lesson is that AI detection must become structural, not purely semantic. The article’s strongest signal is not the lure text itself, but the combination of bulky hidden prose, no visible counterpart, and hard-hide CSS. That means security teams should tune for message structure and concealment patterns, then feed those signals into phishing workflows. The conclusion is to score the mismatch, not just the words.

From our research library:

• The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.

What this signals

Rendered-message trust gap: phishing defence now has to account for the difference between what an inbox displays and what a classifier ingests. When attackers can hide large prose blocks in HTML and pair them with cloaked links, the programmatic control point shifts from simple keyword scoring to message reconstruction and visibility-aware analysis.

Email teams should expect more campaigns that are engineered for the machine first and the human second. That changes triage, because a benign-looking body may still carry malicious structure in the source, and security operations need rules that prioritise concealment patterns over superficial tone.

For practitioners

• Build separate rendering and source analysis Compare the rendered email body against the raw HTML so concealed text is scored as an evasion technique, not ordinary content.
• Detect hard-hide CSS patterns Flag display:none, opacity:0, font-size:0 and off-screen positioning when they hide large blocks of text that do not appear in the visible message.
• Penalise bulky concealed prose Treat long hidden filler with no visible counterpart as a high-risk structural indicator, especially when it sits beside a short lure and a link.
• Validate link destinations in user context Follow redirects as a real mailbox user would, then compare that path with what automated scanners receive from the same URL.

Key takeaways

• Hidden-text phishing works because security tooling and users may see different versions of the same message.
• The strongest signal in the campaign is structural, not linguistic, because bulky concealed prose and cloaked links travel together.
• Defence needs visibility-aware inspection that compares rendered email with source HTML and treats concealment as suspicious.

Key terms

• Text Salting: Text salting is the practice of padding a phishing email with large amounts of hidden HTML text so automated classifiers read a different message than the recipient. The technique exploits the gap between rendered content and source content, making scoring models easier to dilute without changing what the human sees.
• Hard-Hide CSS: Hard-hide CSS refers to styling methods that make text invisible to users and most mail clients, such as display:none, opacity:0, font-size:0, or moving content off-screen. In phishing, these methods are used to conceal filler text from the recipient while leaving it available to machine scanners.
• Cloaking Redirect: A cloaking redirect is a link path that shows different destinations to different requesters, usually sending scanners to a harmless page and humans to a malicious one. This undermines link reputation checks because the analysed destination depends on who is asking and how the request is made.
• Rendered-Message Trust Gap: The rendered-message trust gap is the mismatch between what a user can actually see in an email client and what a security tool evaluates from the raw HTML. Attackers exploit that gap by hiding content that influences machine scoring but never reaches the human reader.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security and secrets management. It helps security practitioners connect identity controls to the wider access and abuse patterns that shape real-world risk.