Hackers Exploit CSS Properties to Conceal Malicious Code in Hidden Text Salting Attacks

Hackers are exploiting Cascading Style Sheets to embed hidden “salt”—irrelevant content that confuses detection systems—deep within HTML emails, a technique Cisco Talos tracks as hidden text salting. According to Cisco Talos, a year-long monitoring period from 1 March 2024 to 31 July 2025 shows a marked rise in CSS abuse to conceal malicious code and hinder both signature-based and ML-driven defenses.

The salts are hidden by CSS properties such as font-size:0, opacity:0, display:none, and related sizing or clipping techniques, making them invisible to users but legible to parsers and language detectors. In one PayPal-impersonating scam, a sentence was concealed in a div with font-size:1px and line-height:0 and only revealed when font size was increased to 20px; Harbor Freight phishing emails used hidden French salt via a display:none tactic.

Mitigations call for detection and filtering that analyse CSS usage, visual discrepancies, and sanitisation of HTML at ingestion, with AI-driven analyses and prompt guards to ignore content styled as hidden.