Hidden text salting in scam emails ramps up

More threat actors have leveraged hidden text salting, or poisoning, to better conceal malicious code in HTML-format scam emails since the second half of last year, Cybernews reports.

Hidden text salting has not only been used to evade spam filters' keyword detection capabilities as shown in separate phishing attacks impersonating Wells Fargo and Norton LifeLock but also to dupe the language detection module of Microsoft and circumvent security filters, according to findings from Cisco Talos, which emphasized the importance of sophisticated artificial intelligence- and visual feature-based filtering techniques. "Protecting against these sophisticated and devious threats requires a comprehensive email security solution that harnesses AI-powered detections," said Cisco Talos researchers. Such a development comes after Microsoft disclosed a now-addressed critical Outlook zero-click flaw, which could be exploited to facilitate malware delivery through specially crafted emails. Users have been urged to read emails in plain text to mitigate potential compromise.