As reported by Dark Reading, a campaign exceeding one million emails has been observed leveraging hidden text insertion — commonly called text salting — to systematically evade AI-powered and LLM-based email security platforms. What makes this development particularly notable isn't the technique itself, which has existed for years, but rather the scale at which it's now being deployed and its measurable success rate against modern defenses marketed as AI-native.
Why This Matters More Than It Might Appear
The cybersecurity industry has spent the better part of three years aggressively marketing AI and large language models as the definitive answer to phishing. Vendors have promised contextual understanding, semantic analysis, and behavioral pattern recognition that would finally outpace signature-based detection. Text salting attacks directly challenge that narrative — and the evidence at scale is hard to dismiss.
Text salting works by inserting hidden characters, zero-width Unicode sequences, white-on-white text, or randomized benign content into email bodies. The goal is to fragment the semantic fingerprint of the message so that AI classifiers — which often tokenize and vectorize content before analysis — see something statistically different from known-malicious templates. In essence, attackers are poisoning the feature space the model relies on, without the end recipient ever noticing a visual difference.
"The attack doesn't break AI — it exploits the fundamental assumption that what the model sees and what the user sees are the same thing. They aren't."
This is a meaningful distinction. Traditional rule-based filters could be tuned to detect suspicious Unicode ranges or hidden HTML elements. But AI models trained on rendered or normalized text may never encounter the raw manipulation. If the preprocessing pipeline strips or normalizes these artifacts before the model analyzes content, the evasion is effectively invisible to the classifier while remaining fully functional in the delivered email.
Who Is Most Exposed
Organizations that have fully migrated away from layered, rule-based filtering in favor of AI-only email security are carrying the highest risk. This includes:
The Broader Implication: Adversarial ML Is Now Operational
For years, adversarial machine learning was largely an academic concern — researchers demonstrating theoretical bypasses in controlled environments. What this campaign represents is the operationalization of adversarial input techniques at commodity scale. Threat actors don't need to understand the mathematics of transformer models; they simply need to discover empirically that inserting junk Unicode defeats the filter, and then automate it. The barrier to exploiting AI security tools is lower than the industry has acknowledged.
This also signals a coming arms race specifically around AI email security. As vendors patch their preprocessing pipelines to handle known salting techniques, attackers will iterate. The game theory here favors the attacker: defenders must catch everything; attackers only need to find one evasion that works.
Shield53 Recommendations
Immediate Actions
- Audit your email security stack's preprocessing pipeline. Ask your vendor directly: does your model analyze raw MIME content, rendered HTML, or normalized plain text? The answer determines your exposure to text salting.
- Re-enable or add rule-based detection layers specifically targeting zero-width characters (U+200B, U+FEFF, U+00AD), excessive hidden HTML elements, and anomalous Unicode density in email bodies. AI should augment rules, not replace them.
- Test your current platform by sending controlled text-salted samples through your filtering environment and reviewing whether they're quarantined or delivered. Many vendors will assist with this assessment.
- Increase phishing simulation frequency with campaigns that incorporate hidden text techniques to gauge real-world user susceptibility when technical controls fail.
- Review DMARC, DKIM, and SPF enforcement posture — while these don't address content evasion, ensuring strict authentication policies reduces the sender-spoofing component often paired with these campaigns.
Strategic Guidance for Security Leaders
- Demand adversarial robustness testing from email security vendors as part of procurement and annual reviews — not just standard detection rate benchmarks.
- Treat AI email security as one layer, not the layer. Defense-in-depth in email means authentication controls, content inspection, sandboxing, endpoint detection, and user training operating in concert.
- Establish a process for users to easily report suspicious emails and ensure those reports feed back into your detection tuning — human intuition still catches what classifiers miss.
The core lesson here isn't that AI is useless in email security — it remains valuable. The lesson is that any single-control reliance creates a single point of failure, and threat actors are actively probing those failure points at industrial scale.
