Cisco Talos Blog: Seasoning email threats with hidden text salting

Jan 24, 2025

—

Source URL: https://blog.talosintelligence.com/seasoning-email-threats-with-hidden-text-salting/
Source: Cisco Talos Blog
Title: Seasoning email threats with hidden text salting

Feedly Summary: Hidden text salting is a simple yet effective technique for bypassing email parsers, confusing spam filters, and evading detection engines that rely on keywords. Cisco Talos observed an increase in the number of email threats leveraging hidden text salting.

AI Summary and Description: Yes

**Summary:** The text presents insights into an emerging email threat technique known as hidden text salting, which is used by cybercriminals to bypass email filters and detection mechanisms. This method poses significant challenges to information security professionals as it complicates the detection of phishing and spam emails. The emphasis on advanced filtering solutions and AI-powered detection strategies underscores its relevance for cybersecurity.

**Detailed Description:**
– **Hidden Text Salting:** This technique involves embedding imperceptible characters within the HTML source of emails. This can confuse email parsers and spam filters that depend on keyword detection.
– **Methods of Evasion:**
– **Brand Name Extraction:** Threat actors deploy hidden characters to evade identification by parsers that extract brand names from email content.
– **Language Detection Confusion:** By embedding hidden text, attackers can manipulate the language output seen by email filtering systems, making an English email appear to be in French, for example.
– **HTML Smuggling:** This involves inserting irrelevant comments in HTML attachments to prevent detection engines from decoding base64-encoded payloads.

– **Examples Provided:**
– Phishing emails impersonating legitimate brands like Wells Fargo and Norton LifeLock showcase how zero-width characters can be used effectively.

– **Mitigation Strategies:**
– **Advanced Filtering Techniques:** Developing filters capable of detecting CSS properties commonly used for hiding text (e.g., `visibility: hidden`, `display: none`).
– **Relying on Visual Features:** Implementing additional detection strategies that assess the visual attributes of emails, not solely textual data.

– **Role of AI in Defense:** Utilizing AI-powered email security solutions can dramatically improve detection capabilities against sophisticated threats, such as:
– Natural Language Processing and machine learning models to identify and categorize threats effectively.

– **Call to Action:** A recommendation for organizations to adopt enhanced email threat defense solutions and consider a free trial to bolster their security posture against these tactics.

In conclusion, the identified methods of hidden text salting in phishing attacks reveal significant gaps in traditional email filtering systems. The recommendations for advanced detection efforts and AI-driven solutions are particularly valuable for IT security teams, emphasizing the need for proactive measures in safeguarding against evolving email threats.

4 a Act advanced detection advanced filtering techniques AGI AI and Argo art as attack attackers attacks base64 by bypass C capabilities challenges Cisco Cisco Talos code coding content core css cyber cybercriminal cybercriminals Cybersecurity D data de defense detection detection capabilities detection engines detection mechanisms detection strategies driven driven solutions e effective email Email Filtering email security email security solutions email threats end evasion event extraction features filtering for g Gen git Go hidden text salting HR http HTTPS in information information security information security professionals insights Intel intelligence k l language language processing learning led life mac machine Machine Learning machine learning model machine learning models making mitigation mitigation strategies ML model models natural language natural language processing no non o of on one opt organization organizations out PAM parsers phi phishing phishing attack Phishing Attacks phishing emails post Power pre proactive proactive measures processing professionals R rag rate RCE red Ro Role s salting sec security security posture security professionals security solutions security teams side Sig Sim Simple source spam spam filters SSE system systems T tactics Teams tech techniques text the threat threat actor threat actors threats to Tor TP trial US use V val visibility Well Wi x zero