Seasoning email threats with hidden text salting
Summary: Cisco Talos described hidden text salting, a technique that uses HTML and CSS features to insert comments and irrelevant content invisible to the recipient but able to confuse parsers, spam filters, and keyword-based detection engines. Talos documented it in phishing emails impersonating Wells Fargo (a zero-width style block), Norton LifeLock (zero-width space and non-joiner characters between letters), and Harbor Freight (hidden French text that caused Microsoft's X-Forefront-Antispam-Report LANG field to record the message as French), and in HTML smuggling where comments were inserted between base64-encoded characters.
What's compelling: The Harbor Freight case shows the technique already defeating a production control: Microsoft's Exchange Online Protection tagged an English phishing email as French because of hidden text. A parser that cannot see what the recipient sees is grading an email the attacker wrote for it, not the one that lands in the inbox.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026