Hackers Abuse CSS Properties With Messages to Inject Malicious Codes in Hidden Text Salting Attack

Cybersecurity: Hidden Text Salting in Email Security

A sophisticated method, known as hidden text salting, has become a significant threat to email security systems, enabling cybercriminals to bypass detection by manipulating cascading style sheets (CSS) properties.

This technique allows threat actors to embed non-visible content within malicious emails, rendering it invisible to recipients.

Hidden text salting is utilized in various threat categories, including phishing, scams, and advanced persistent threats targeting high-value organizations.

This method marks a shift in email-based attacks, moving from traditional content evasion to exploiting the foundation of web presentation standards.

By altering CSS properties like font-size, opacity, display visibility, and container dimensions, attackers can inject hidden content that confuses detection systems while maintaining visual integrity.

This approach is effective against both signature-based security solutions and advanced machine learning models that rely on textual analysis.

The technique is implemented across four main email components: preheaders, headers, message bodies, and HTML attachments, each offering unique evasion advantages.

Body injection is the most common, allowing for extensive content dilution, while attachment-based salting complicates static analysis procedures.

Cisco Talos researchers identified this threat pattern through monitoring over sixteen months of email campaigns, from Mar 2024 through Jul 2025.

The research shows that hidden text salting is more prevalent in malicious emails than legitimate ones, with spam and phishing campaigns showing higher usage rates.

This technique is employed by multiple threat actor groups, ranging from simple character insertion to complex multilingual content injection.

Beyond traditional email security, this method could impact modern defense systems incorporating large language models for threat analysis.

Researchers have shown that minimal hidden content can alter sentiment analysis and intent classification by AI-driven security tools.

Technical Implementation Methods and Detection Evasion

Hidden text salting relies on three primary CSS property manipulation categories: text properties, visibility controls, and dimensional constraints.

Text concealment involves setting font-size to zero, matching font and background colors, or adjusting line-height to render content invisible.

Visibility abuse uses CSS properties like "display: none," "visibility: hidden," or "opacity: 0" to hide content while preserving it in the HTML source.

Dimensional manipulation focuses on creating HTML elements with zero dimensions, clipping content beyond visible boundaries.

Advanced implementations incorporate responsive design, ensuring hidden content remains concealed across different platforms.

Some campaigns use CSS selectors to apply concealment across multiple HTML elements, reducing code redundancy.

Character-level injection involves inserting zero-width space or non-joiner characters, breaking keyword matching algorithms.

Research by Cisco Talos indicates that hidden text salting has evolved into a sophisticated attack methodology, challenging both traditional and next-generation email security solutions .

Based on reporting by Cyber Security News.