Attackers Season Spam With a Touch of 'Salt'

Attackers are increasingly using hidden content in emails through Cascading Style Sheets (CSS) to bypass filters and hamper enterprise security tools. The tactic, nicknamed “salting” or “hidden text salting,” adds noise like random characters and invisible content that is only visible when inspecting the HTML, with the goal of confusing parsers and detection engines.

Cisco Talos has tracked this technique over several months, noting that threat actors use CSS features to insert hidden material into headers, pre-headers, bodies and attachments, sometimes setting text to opacity or display to none to keep salts invisible to users. In a recent example, a phishing email purporting to be from Blue Cross Blue Shield included the words “FOUR yummy soup recipes just for you!” in the preheader, while CSS ensured the text remained hidden from view.

The researchers say the amount of hidden content can vary depending on defence capabilities, and they offer mitigation steps such as HTML sanitisation at ingestion and deployable filters to ignore visually hidden content. according to Cisco Talos.