[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAbE6MA8Vm7246_UvUhxEzWvPkh4KCQJRh4NsojNvvDs":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"5ff8deba-2ec4-40a3-bc6b-9f495dab195b","text-salting-technique-bypasses-ai-email-security-filters-at-scale","1cae29dd-59a7-42b0-831f-1b879e47ebd8","Text Salting Technique Bypasses AI Email Security Filters at Scale","Threat actors are exploiting a fundamental weakness in how AI-powered email security tools parse and interpret obfuscated text, using a technique called 'text salting' to hide malicious phishing content from machine learning detectors. Over one million phishing emails have successfully evaded detection, demonstrating that over-reliance on AI-based filtering as a single layer of defense creates a dangerous blind spot. This attack is particularly insidious because the obfuscation is invisible or seamless to human recipients, meaning users remain the last line of defense. The incident underscores that AI security tools, while powerful, can be systematically manipulated and must not be treated as infallible gatekeepers. Organizations that have not trained employees to recognize phishing independently of their technical controls are especially vulnerable.","**Immediate actions:**\n- Audit your current email security stack to confirm it is not solely reliant on a single AI\u002FML-based filtering solution.\n- Issue urgent phishing awareness reminders to all staff, emphasizing that filtered inboxes are not guaranteed to be safe.\n- Report suspicious emails through established channels so security teams can identify potential text-salting patterns in your environment.\n\n**Long-term improvements:**\n- Deploy a defense-in-depth email security architecture that layers AI filtering with rule-based detection, sandboxing, and DMARC\u002FDKIM\u002FSPF enforcement.\n- Conduct regular, simulated phishing exercises that include novel obfuscation techniques to build employee resilience beyond what technical filters catch.\n- Engage email security vendors to request transparency on how their models handle obfuscated or salted text, and push for model updates addressing this class of attack.\n\n**Detection measures:**\n- Implement robust email logging and anomaly monitoring to flag unusual encoding patterns, excessive Unicode characters, or irregular whitespace in message bodies.\n- Establish behavioral alerting for downstream indicators of phishing success, such as unexpected credential usage or OAuth token grants following email delivery.\n- Integrate threat intelligence feeds that track emerging adversarial ML evasion techniques to proactively update detection rules.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 8 – Audit Log Management","NIST SP 800-61 – Incident Handling Guide","NIST SP 800-177 – Trustworthy Email","NIST AI RMF – Govern 1.2 (AI Risk Awareness)","NIST CSF DE.CM-3 – Personnel Activity Monitoring","MITRE ATT&CK T1566 – Phishing","MITRE ATT&CK T1036 – Masquerading \u002F Obfuscation","GDPR Article 32 – Security of Processing (appropriate technical measures)","ISO\u002FIEC 27002:2022 Control 8.23 – Web Filtering","ITIL 4 – Problem Management (systemic vendor control weaknesses)",{},"published","2026-07-16T22:21:00.556512+00:00","2026-07-16T22:21:00.247+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.darkreading.com\u002Fthreat-intelligence\u002F1m-emails-hidden-text-dupe-ai-security-filters","1m-emails-use-hidden-text-to-dupe-ai-security-filters-a3930e","1M+ Emails Use Hidden Text to Dupe AI Security Filters",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":40,"name":41,"slug":42,"description":43,"color":44},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":46,"name":47,"slug":48,"description":49,"color":50},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[53,57,61],{"slug":54,"name":55,"problem":56},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",{"slug":58,"name":59,"problem":60},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":62,"name":63,"problem":64},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]