Forest Global Training Partners

Cyber Risks · Cisco Talos

Too salty to handle: Exposing cases of CSS abuse for hidden text salting

Summary: Cisco Talos documented over a year of monitoring, from March 1, 2024 to July 31, 2025, showing a rise in hidden text salting, where adversaries inject irrelevant content into emails and conceal it with CSS so it is invisible to recipients. Talos found the salt placed in preheaders, headers, attachments and most commonly the email body, using characters, paragraphs and comments hidden via properties such as font-size: 0, opacity: 0, display: none and zero-width characters like ZWSP and ZWNJ.

Bottom line: Talos observed this concealment far more often in spam and email threats than in legitimate mail, and notes attackers use it to confuse language detection and static analysis of HTML attachments, so a filter that parses the HTML source can be fed decoy content the recipient never sees.

Read the original at Cisco Talos ↗

Topics
Malware
Related