[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcMoYlnF-fptBwaKSVIi6z1H-E_dlzhYqhMKVjsCRGxg":3},{"article":4,"iocs":39,"watch_terms":43,"solutions":44,"lesson":130},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"1cae29dd-59a7-42b0-831f-1b879e47ebd8","1M+ Emails Use Hidden Text to Dupe AI Security Filters","1m-emails-use-hidden-text-to-dupe-ai-security-filters-a3930e","Artificial intelligence and LLMs can be surprisingly ineffective against text salting, allowing phishing emails to slide right into your inbox.","Researchers discovered that over 1 million phishing emails are successfully bypassing AI-powered email security filters by using text salting—a technique that hides malicious content from machine learning detectors while remaining visible or functional to recipients. The attack exploits weaknesses in how LLMs process obfuscated text, allowing threat actors to deliver phishing payloads undetected. This highlights a critical gap in current AI-based email security solutions.","Over 1M phishing emails evade AI security filters using hidden text salting techniques.","https:\u002F\u002Fwww.darkreading.com\u002Fthreat-intelligence\u002F1m-emails-hidden-text-dupe-ai-security-filters","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt6711706d56131707\u002F6a591f652d194555193b1cc9\u002FSalt_email-Sagel_&_Kranefeld-Getty.jpg?width=720&quality=80&disable=upscale","2026-07-16T19:41:31+00:00","2026-07-16T22:00:25.447526+00:00",8,[17,20],{"name":18,"type":19},"LLM-based email security filters","technology",{"name":21,"type":22},"text salting phishing campaign","campaign","839da5c1-3c34-47e2-9499-f7201640e3ac",{"id":23,"icon":25,"name":26,"slug":27},null,"AI Security","ai-security",[29,34],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[40],{"type":33,"value":41,"context":42},"text salting phishing","Evasion technique using hidden text to bypass AI email security filters",[],{"controls":45,"vendors":129},[46,74,103],{"slug":27,"name":47,"problem":48,"products":49},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"slug":75,"name":76,"problem":77,"products":78},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"slug":104,"name":105,"problem":106,"products":107},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[108,114,122],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":109,"product_name":110,"url":112,"description":113},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":104,"product_name":126,"url":127,"description":128},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":131,"title":132,"body":133,"framework_refs":134,"framework_notes":147},"text-salting-technique-bypasses-ai-email-security-filters-at-scale","Text Salting Technique Bypasses AI Email Security Filters at Scale","Threat actors are exploiting a fundamental weakness in how AI-powered email security tools parse and interpret obfuscated text, using a technique called 'text salting' to hide malicious phishing content from machine learning detectors. Over one million phishing emails have successfully evaded detection, demonstrating that over-reliance on AI-based filtering as a single layer of defense creates a dangerous blind spot. This attack is particularly insidious because the obfuscation is invisible or seamless to human recipients, meaning users remain the last line of defense. The incident underscores that AI security tools, while powerful, can be systematically manipulated and must not be treated as infallible gatekeepers. Organizations that have not trained employees to recognize phishing independently of their technical controls are especially vulnerable.",[135,136,137,138,139,140,141,142,143,144,145,146],"CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 8 – Audit Log Management","NIST SP 800-61 – Incident Handling Guide","NIST SP 800-177 – Trustworthy Email","NIST AI RMF – Govern 1.2 (AI Risk Awareness)","NIST CSF DE.CM-3 – Personnel Activity Monitoring","MITRE ATT&CK T1566 – Phishing","MITRE ATT&CK T1036 – Masquerading \u002F Obfuscation","GDPR Article 32 – Security of Processing (appropriate technical measures)","ISO\u002FIEC 27002:2022 Control 8.23 – Web Filtering","ITIL 4 – Problem Management (systemic vendor control weaknesses)",{}]