Recent reports indicate that AI-powered spam filters are being compromised by a long-standing technique known as text salting. This method, which has been used for years to deceive traditional email security systems, is now also affecting machine-learning-based filters, according to cybersecurity firm Barracuda.
Text Salting Explained
Text salting involves embedding benign-looking words within a malicious email to confuse automated scanning systems. Barracuda has identified over one million phishing attacks utilizing this technique since April 2026. The goal is to trick the email filter into classifying the malicious message as harmless.
How Attackers Implement Text Salting
Attackers employ various methods to conceal the added text from human readers while remaining detectable by automated systems. Techniques include:
- CSS cropping: This method restricts the visible area of the email, hiding the extra text.
- Text manipulation: This moves the hidden text outside the visible screen area.
- Zero font techniques: This inserts misleading words that are visible to machines but not to humans.
These tactics result in emails that appear less malicious to AI systems, leading them to misclassify the content.
Challenges for AI Filters
While modern email security solutions have adapted to detect hidden text, Barracuda notes that AI systems have not kept pace. The firm states, “Text salting and related techniques can be used to confuse AI-driven content analysis engines by flooding the email with random terms that encourage the AI system into making an incorrect classification decision.” This indicates a significant gap in the ability of AI filters to accurately assess email content.
Recommendations for Enhanced Email Security
To mitigate the risks associated with text salting, Barracuda advises organizations to adopt a layered approach to email security. This includes not solely relying on keyword detection but also evaluating sender reputation, authentication results, embedded URLs, and the differences between visible and hidden content. Organizations may also consider reassessing their reliance on AI spam filters to improve overall email security.
This article was produced by NeonPulse.today using human and AI-assisted editorial processes, based on publicly available information. Content may be edited for clarity and style.
