Topic starter
23/10/2026 12:45 am
TL;DR: IRONSCALES measured hidden-text phishing as a pattern that lets security tooling and users see different versions of the same message. Email inspection has to compare rendered content with source HTML so bulky concealed prose and cloaked links do not pass as ordinary mail.
Editorial analysis by NHI Mgmt Group, based on content published by IRONSCALES: “Text Salting: Why Hidden-Text Phishing Grew 9x in Six Months”.
By the numbers:
- Hidden-text blocks appeared in about 7% of evasive phishing cases over six months, according to IRONSCALES.
- The technique grew from about 1% in December 2025 to 11% by June 2026, according to IRONSCALES.
Key questions
Q: Why does hidden text make phishing harder for AI email filters to catch?
A: Because many filters score the full HTML text, while the recipient sees only the rendered message.
Q: What are the signs that email text salting is being used in a campaign?
A: Look for a short visible lure, a much larger hidden HTML block, and CSS that makes the text disappear with display:none, opacity:0, font-size:0, or off-screen placement.
Q: What should email security teams do when phishing starts hiding text from classifiers?
A: They should stop relying on a single raw-text score and compare the rendered email with the HTML source.
Practitioner guidance
- Build separate rendering and source analysis Compare the rendered email body against the raw HTML so concealed text is scored as an evasion technique, not ordinary content.
- Detect hard-hide CSS patterns Flag display:none, opacity:0, font-size:0 and off-screen positioning when they hide large blocks of text that do not appear in the visible message.
- Penalise bulky concealed prose Treat long hidden filler with no visible counterpart as a high-risk structural indicator, especially when it sits beside a short lure and a link.
Bottom line: Hidden-text phishing works because security tooling and users may see different versions of the same message.
Glossary terms: Text Salting, Hard-Hide CSS, Cloaking Redirect, Rendered-Message Trust Gap
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
Hidden-text evasion is now a production phishing pattern, not a niche trick. The article shows consistent pairing between concealed prose and cloaking redirects, which is exactly what toolchain-generated abuse looks like. That matters because security teams often treat evasion as an exception, when in reality the adversary has standardised it. Practitioners should assume the bypass is repeatable, not opportunistic.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: When does phishing content inspection fail because of cloaking redirects?
A: It fails when scanners and real users are sent to different destinations from the same link. If a crawler sees a benign decoy but a user reaches a credential-harvesting page or fraud funnel, the link analysis layer has been deceived and the email should be treated as hostile.
👉 Read our full editorial: Text salting is becoming an industrial phishing bypass
This post was modified 6 days ago by NHI Mgmt Group