Text salting disrupts brand detection systems

A new report has revealed a significant increase in the use of so-called “ Hidden Text Salting ” techniques to bypass email security measures during the second half of 2024

See also: Malicious PowerShell scripts: What they are and how to protect yourself

“Hidden Text Salting” refers to the process of secretly inserting data into a text. This technique is often used in data security, encryption, and for malicious activities. With this method, small but strategically placed changes are made to the text to add invisible information, without affecting the normal reading of the content by the user.

This technique, known as “poisoning,” allows cybercriminals to bypass spam filters, confuse email parsers, and evade detection enginesby embedding invisible elements into the HTML source code of emails, making malicious messages more difficult to detect.

Cisco Talos' latest report , Hidden Text Salting in Email Threats: Trends and Mitigation Strategies , highlights the growing prevalence of this simple but effective tactic.

One example involved phishing emails that mimicked brands like Wells Fargo and Norton LifeLock . By hiding characters using CSS properties or inserting ZWSP characters, these emails avoid brand extraction from security systems.

See also: Hackers exploit old vulnerabilities in Ivanti CSA

Another notable case showed attackers disguising English emails as French, embedding hidden French words, which fooled Microsoft's Exchange Online Protection (EOP) spam filter

The study also highlights the use of Hidden Text Salting in HTML smuggling. In these cases, attackers hid malware in email attachments by embedding irrelevant comments in base64-encoded strings. This approach disrupted detection engines that typically scan attachments for threats.

Given the challenges this tactic poses, experts recommend adopting advanced filtering techniques that analyze the structure of HTML emails. For example, filters can flag excessive use of inline styles or suspicious CSS properties like “visibility: hidden.”

Additionally, leveraging AI-powered systems to analyze both text and visual elements of emails can improve detection rates.

See also: Mission Bank: Is RansomHub behind the data breach?

The report highlights the critical need for comprehensive email security solutions to address the growing threat of cyberattacks .As attackers continue to evolve their techniques, organizations must remain vigilant, adopting proactive measures and defense strategies against attacks that exploit email as a primary medium.

Source: infosecurity-magazine