Barracuda says text salting can confuse AI email filters

A decades-old spam-evasion method is being used against modern AI-powered email defenses. Barracuda Networks says it detected more than one million retail-themed phishing messages using text salting since April 2026. The campaigns commonly promise rewards, points, gift cards or urgent redemption offers while inserting benign-looking text that the recipient does not see.

The count comes from Barracuda's threat telemetry. It is evidence of a large observed campaign, not an industry-wide measurement of all phishing, unique victims, successful deliveries or compromised accounts.

The attack creates a difference between what an automated system processes and what a person sees. A gateway may ingest raw HTML, visible copy, hidden copy and metadata as one text stream. The recipient sees only the phishing lure.

Barracuda describes several concealment techniques:

• •CSS cropping limits the visible portion of inserted text.
• •Off-screen positioning moves filler content outside the user's viewport.
• •Zero-height containers or zero-size fonts keep text in the source while hiding it visually.
• •Broken-up phrases insert harmless tokens between suspicious words.

Barracuda says benign tokens can dilute warning signals or change a classifier's interpretation when the system does not distinguish rendered content from hidden source. Dark Reading and The Register independently covered the disclosure, but neither independently reproduced Barracuda's telemetry or benchmarked named products.

The public report does not test a representative set of AI email products under controlled conditions. It therefore does not establish that every LLM-based filter is vulnerable, that traditional controls are obsolete or that an AI classifier is the only component being bypassed.

Authentication also has a narrower role than many users assume. A valid DKIM result can show that a domain authorized a message; it does not prove that the sender, site or content is trustworthy. Text salting targets the content-analysis layer after other checks may already have passed.

This is primarily a data-pipeline and representation problem, not proof that language models are unusable for email security. A classifier cannot reliably reason about visibility if its input collapses hidden and visible text into one undifferentiated sequence.

Production defenses should render the message, extract what a recipient actually sees, compare that representation with the raw source and treat large contradictions as adversarial evidence. Model confidence should not override malicious destinations, suspicious HTML concealment or abnormal sender behavior. Adding an LLM to a secure email gateway can improve semantic analysis, but it does not remove the need for preprocessing, layered signals and continuous adversarial testing.