Old email tricks fool AI spam filters, Barracuda warns

Barracuda, an email security company, issued a report on Thursday detailing how text salting—a venerable email evasion technique—continues to fool modern AI-powered email filters. Since April, Barracuda has detected more than one million retail-themed phishing attacks leveraging this method. Text salting works by embedding random, benign-sounding words throughout a malicious email to confuse automated scanning systems into misclassifying the message as legitimate. To prevent human readers from becoming suspicious, attackers employ three primary concealment methods: CSS cropping shrinks the visible window so hidden text remains off-screen; text manipulation shifts filler content beyond the visible area; and zero-font techniques insert misleading words in invisible font between visible phishing content. The result is an email that appears harmless and filled with gibberish to a machine but reads exactly as the attacker intended when opened by a person. Traditional secure email gateways have developed robust defenses against these tricks over the years, incorporating hidden-text removal and alerting mechanisms. LLM-based and machine-learning email security tools, however, have not kept pace. According to Barracuda, these systems are typically designed to process email text straightforwardly without understanding whether content is visible or hidden to the user. While they could theoretically be trained to distinguish visible from hidden text, most deployed tools apparently do not perform this task by default. Barracuda recommends that enterprises adopt a layered email security approach rather than relying solely on keyword detection, including checks of sender reputation, authentication results, embedded URLs, HTML-rendering techniques, and the detection of discrepancies between user-visible and hidden content.

Text salting is not a new attack vector; it has been used against traditional secure email gateways for years and is rooted in early 2000s spam-evasion techniques. Modern email security systems have largely adapted to these tactics by implementing defenses such as hidden-text removal, alerting on suspicious volumes of concealed content, and other countermeasures. However, the shift toward LLM-based and machine-learning security tools has created a regression: these newer AI systems process email content without inherent awareness of the distinction between visible and hidden text. While they can theoretically be trained to make this distinction, most deployed tools apparently lack this capability by default. The result is that attackers have found a way to exploit a gap in AI's capabilities that older, more specialized security software had already closed, exposing enterprises that have adopted AI-only or AI-dominant email filtering strategies to an old threat wearing new clothes.