A Million Phishing Emails Hid Nonsense Words to Fool the AI Guarding the Inbox

Your security filter read a paragraph about puppies. Your employee saw a phishing lure.

Since April 2026, attackers have sent more than one million phishing emails that carry two messages at once. The one a person sees is a short, urgent notice that their retail rewards points or a gift card are about to expire. The one hidden underneath, invisible on screen but sitting in the email's code, is a wall of harmless filler: stray words like puppy, training, book, and rhythm, snippets of stories, fragments of meeting notes. That second message is not there for the reader. It is there for the software.

Barracuda's threat researchers, who disclosed the campaign on July 16, 2026, call the trick text salting. It is aimed squarely at a defense many companies switched on over the last two years: email security that uses AI to judge whether a message is malicious. The lure reaching the inbox has not changed. What changed is that the filter standing in front of it can now be talked out of blocking it.

How the trick works

Traditional spam filters hunt for suspicious words. Newer systems use a large language model (LLM, the same kind of AI that powers chatbots) to weigh the whole message and score how likely it is to be an attack. Text salting exploits how that scoring works. A phishing email is dense with tell-tale terms: reward, expires, gift card, verify now. Bury those few words inside thousands of innocent ones and the overall mix reads as ordinary, so the model's confidence that the message is an attack falls below the line that would quarantine it. The attacker is not hiding the phishing words. They are drowning them.

The concealment is ordinary web plumbing. Attackers use HTML and CSS (Cascading Style Sheets, the code that controls how a page looks) to crop the visible area, shrink line height to nothing, push text off-screen, and suppress scrollbars, so the filler never renders for the reader. A sharper variant, called Zero Font, splices invisible characters into the middle of the phishing words themselves. The raw code might read "Your pass[hidden text]word expired," with the inserted text set to a font size of zero. The recipient reads "Your password expired." A detection engine scanning the source for that exact phrase reads something else, and lets it pass.

• Barracuda has counted more than one million of these emails since April 2026, all part of a retail-themed campaign promising expiring rewards, loyalty points, or gift cards.
• The sending infrastructure runs on compromised legitimate websites and lookalike domains configured with DKIM (DomainKeys Identified Mail, a signature that proves an email really came from the domain it claims), so the messages clear the authentication checks that filters trust.
• Generative AI supplies the salt. It can produce endless, varied, realistic-looking filler on demand, so no two emails carry the same padding and pattern-matching has nothing fixed to catch.

Why it matters

Nobody lost a headline sum here, because text salting is a delivery technique, not the payload. Its whole job is to slip a credential-stealing lure into an inbox that an AI filter was supposed to keep clean, and at a million messages and counting, plenty are landing. The uncomfortable part for your team is what it says about the tool you may have just bought. If your organisation moved to AI-based email security on the promise that it reads context better than a keyword filter, this campaign targets exactly that reading, and it does so without altering a single word your staff will see. The email in the inbox is as convincing as ever. The machine meant to stop it has simply been handed a different reality. The broader pattern is the one worth sitting with. Text salting is an old spam trick, years older than LLM filters, and attackers dusted it off the moment those filters became common. That is the recurring shape of this era: each new AI defense becomes a new surface to poison, and the classifier's input is now part of the attack surface. Defenders who assumed a smarter model was automatically a safer one are learning that a model is only as trustworthy as the text you let reach it.

What to do about it

1. Choose email security that analyses the rendered message, not just the source code. The whole trick depends on a gap between what the code says and what the human sees, so a filter that judges the email as it actually displays has nothing to be salted with.
2. Deploy phishing-resistant MFA (multi-factor authentication, the second login step beyond a password), such as passkeys or FIDO2 security keys. If a lure does land and someone types their password, a login that also demands a physical key or passkey means the stolen password alone opens nothing.
3. Turn on time-of-click link protection or remote browser isolation. The message carries no obvious malware, so the danger sits behind the link, and checking or sandboxing the destination at the moment of the click catches what the inbox scan missed.

Bottom line

Text salting is a reminder that an AI filter is not a lie detector. It reads what it is given, and attackers have found a cheap, scalable way to feed it a soothing paragraph about puppies while showing your employee an expiring gift card. The answer is not one smarter model but layers that do not share the same blind spot: judge the email as rendered, verify identity with something a password thief cannot copy, and check the link at click time. One question is worth raising before your next renewal. Does our email security score the message our people see, or the one hidden in the code beneath it? See the Barracuda threat research for the full technical breakdown.