Text salting in phishing: what should email security teams do?

TL;DR: IRONSCALES research says text salting is no longer an individual evasion trick but an industrial phishing pattern, with hidden-text blocks appearing in about 7% of evasive cases and rising from 1% in December 2025 to 11% by June 2026. The real issue is that machine-scored email can be made to read a different document than the recipient sees, so detection has to separate rendered content from concealed HTML.

Editorial analysis by NHI Mgmt Group, based on content published by IRONSCALES: “Text Salting: Why Hidden-Text Phishing Grew 9x in Six Months”.

By the numbers:

• Hidden-text blocks appeared in about 7% of evasive phishing cases over six months, according to IRONSCALES.
• The technique grew from about 1% in December 2025 to 11% by June 2026, according to IRONSCALES.

Key questions

Q: What should email security teams do when phishing starts hiding text from classifiers?

A: They should stop relying on a single raw-text score and compare the rendered email with the HTML source.

Q: Why does hidden text make phishing harder for AI email filters to catch?

A: Because many filters score the full HTML text, while the recipient sees only the rendered message.

Q: What are the signs that email text salting is being used in a campaign?

A: Look for a short visible lure, a much larger hidden HTML block, and CSS that makes the text disappear with display:none, opacity:0, font-size:0, or off-screen placement.

Practitioner guidance

• Build separate rendering and source analysis Compare the rendered email body against the raw HTML so concealed text is scored as an evasion technique, not ordinary content.
• Detect hard-hide CSS patterns Flag display:none, opacity:0, font-size:0 and off-screen positioning when they hide large blocks of text that do not appear in the visible message.
• Penalise bulky concealed prose Treat long hidden filler with no visible counterpart as a high-risk structural indicator, especially when it sits beside a short lure and a link.

Bottom line: Hidden-text phishing works because security tooling and users may see different versions of the same message.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →