Barracuda's 1 Million Text-Salting Detections Don't Show an AI Bypass Rate

• Barracuda says it detected more than one million retail-themed phishing emails using hidden text since April 2026.
• The company did not publish the total traffic it examined, inbox-delivery results or a comparison of AI and non-AI filters.
• Zero-font and invisible-text evasion predate generative AI; Barracuda's new claim is that AI makes the filler easier to vary at scale.

More than one million detections establish that text salting is being used at volume inside Barracuda's field of view. They do not establish that one million messages defeated security, that AI filters perform worse than traditional gateways or that the campaign represents a known share of global phishing.

A large count without a success rate

Barracuda said in its July 16 report that researchers had detected more than one million attacks since April. The emails used urgent retail-themed promises of rewards, points or gift cards and hid benign prose in the message source.

The company's report does not state the number of messages examined, customers represented, sender domains observed, intended recipients or messages delivered to inboxes. It also does not identify a tested gateway or model, publish false-positive results, or compare salted messages with an unsalted control. The count is therefore a measure of observed activity, not a bypass rate.

One account of the finding described the emails as reaching inboxes. Peterson Gutierrez, Barracuda's vice president of information security, told the publication that the technique's continued and growing use shows it remains effective. Neither that account nor Barracuda supplied delivery data, and no disclosed test explains whether "effective" means passing a gateway, reaching an inbox, eliciting a click or merely remaining popular with attackers. Another report called the activity a sharp increase; the underlying Barracuda post provides no month-by-month series or earlier baseline from which to calculate one.

Nor is "attack" a standardized unit. The Anti-Phishing Working Group's first-quarter 2026 dataset illustrates the mismatch:

APWG calls a unique phishing site an attack and notes that one site can be promoted through thousands of customized URLs. It separately counts differing email subject lines as a measure of lure variety. Barracuda is counting messages or detections, so putting the totals side by side cannot establish market share or a broader phishing trend.

The evasion is old; the claimed production advantage is new

Text salting changes what a scanner processes without changing what the recipient sees. Attackers add random stories, conversations, project notes or words such as "puppy," "training," "rhythm" and "book." The filler can dilute suspicious terms such as "rewards" and "expires," while invisible insertions can break a phrase that an exact-match rule is looking for.

That technique is not an AI-era invention. In 2021, Microsoft documented zero-point-font text intended to throw off machine-learning detection. It said Defender for Office 365 had blocked malicious emails using the method for years, even though attackers continued to deploy it. That history is direct counterevidence to any claim of a novel technical bypass and shows that hidden typography can itself be a detection feature.

Barracuda's narrower claim concerns production economics. It says generative AI can create endless, natural-sounding filler quickly and at no cost, allowing each email to differ. Its example places a dangerous 20-word link within a 400-word invisible story. But the company published no cost measurement, generation method, attribution evidence or comparison with reused human-written filler. "Cheap," "scalable" and "highly varied" remain company assessments.

The UK National Cyber Security Centre's 2025 assessment gives the claim broader context, but not validation. It forecast that AI would highly likely increase intrusion volume and impact mainly by enhancing existing tactics rather than creating new threat vectors. That is a probabilistic forecast about cyber operations through 2027, not evidence that AI-generated salting caused these messages to evade a particular product.

Hidden presentation meets authenticated infrastructure

Barracuda observed compromised legitimate websites and lookalike domains configured with DomainKeys Identified Mail, or DKIM. That matters because a valid signature can help establish a stable identity for reputation checks, but it is not a safety certificate.

The DKIM standard says verification associates a signing domain with hashed message content and establishes that the hashed content has not changed since signing. It explicitly says that verification asserts nothing else about end-to-end integrity, and it leaves trust decisions to other systems. A domain controlled by an attacker can sign malicious content correctly; compromised authorized infrastructure can do the same.

Within the message, the campaign layered several HTML and CSS techniques:

• clip-path: inset(100%) reduces the filler text's visible area to zero, backed by zero height and line height.
• A large negative text indent moves content off-screen, while hidden overflow suppresses the scrollbar.
• Zero-size font inserts invisible terms inside visible phrases, disrupting literal keyword or signature matches.

A technical account confirms that the concealment methods were layered. Barracuda's example inserts invisible random text between "pass" and "word" in "Your password expired." The recipient reads the intact phrase; a scanner matching the raw string may not.

The potential LLM failure is related but narrower than some coverage suggests. Barracuda says models can misread intent, sentiment, purpose or risk if hidden benign prose is passed to them as ordinary message content. A summary of the research goes further, saying hidden and visible text receive equal weight. The primary report says LLMs "often" process raw text without knowing what is invisible unless instructed or trained otherwise; it does not demonstrate equal weighting across products.

The control point is before classification

Adding more banned words will not solve the problem because the filler terms are ordinary language. The useful signal is the mismatch among rendered content, source structure, sender identity, linked destination and requested action.

Barracuda recommends layered analysis of HTML structure, sender reputation, authentication, links, behavioral anomalies and user-visible content. In a follow-up interview and security guide, senior threat analyst Pranati Sethy said defenses need to identify what is hidden and focus on what the recipient sees.

That puts preprocessing and rendering ahead of the choice of classifier. Buyers need evidence that a gateway can expose multiple concealment layers, compare source with rendered output and combine the result with infrastructure and behavioral signals. That guide also recommends authentication checks, structural anomaly detection, behavioral analysis and employee reporting. Those controls reduce dependence on any single content score; they do not prove that a particular gateway catches the campaign.

Downstream controls still matter when delivery succeeds. The same security guide recommends time-of-click URL protection or remote browser isolation and phishing-resistant multifactor authentication. Those measures can limit the consequence of a malicious link or stolen password, but they address impact rather than the salted email's initial classification.

The missing evidence is a controlled bypass test

Security teams can inspect whether their gateways normalize invisible Unicode, expose zero-font and off-screen text, render HTML safely and compare what the user sees with the source. What they cannot infer from the million-message count is which products failed or whether AI-generated filler improved the odds.

A decision-useful study would disclose the traffic population, customer coverage, sampling period and labeling method. It would send the same visible lure through named gateway versions under at least three conditions: no filler, repeated human-written filler and unique AI-generated filler. For each condition it would report detection, quarantine and inbox-delivery rates, plus false positives on legitimate mail that uses hidden HTML for formatting.

That test would separate three propositions now bundled together: attackers are using text salting at scale; generative AI lowers the cost of varying it; and salted messages defeat deployed AI defenses. Barracuda's observations support the first. Its report asserts but does not measure the second. The third remains unquantified.