cyber.hendryadrian.com
Threat Research · blog.talosintelligence.com

Talos Reports Phishing Emails Using Hidden Text to Evade Detection

· Original article ↗

Summary

Talos observed increased use of hidden text salting in email threats during the second half of 2024. Attackers hide characters or content in HTML to confuse parsers, language detection, spam filters, and security engines.

Key points

  • Talos reported increased hidden text salting in email threats in the second half of 2024.
  • Attackers use CSS, HTML comments, and invisible Unicode characters to hide or disrupt text in phishing emails.
  • The technique can obscure brand names from email parsers and insert hidden words to confuse language detection.
  • In HTML smuggling, irrelevant comments inserted among Base64 characters can hinder attachment parsing and decoding.
  • Talos suggests examining suspicious CSS and HTML structure, including hidden content, unusual nesting, and excessive inline styles.
  • Email defenses can also consider visual features alongside text-based analysis.

Article Details

Attack Vectors
  • Phishing emails impersonating Wells Fargo, Norton LifeLock, and Harbor Freight used hidden HTML/CSS content or invisible characters to evade brand extraction, language detection, spam filters, and detection systems.
  • A spear-phishing email used an HTML attachment with irrelevant comments inserted between base64-encoded characters to hinder parsing and decoding.
Defensive Notes
  • Inspect email HTML for suspicious CSS concealment properties such as visibility:hidden and display:none, excessive inline styles, or unusual element nesting.
  • Use visual email characteristics alongside text-based analysis to help identify concealed content.
  • The article recommends advanced filtering and email security solutions that analyze multiple portions of incoming messages, including image-only email content.

Vendors

CiscoCisco Talos observed an increase in the number of email threats leveraging hidden text salting (also known as "poisoning") in the second half of 2024.

Products

Exchange Online Protectioninformation about the message and how it was processed. This header is added to each message by Exchange Online Protection (EOP), Microsoft's cloud-based filtering service.Secure Email Threat Defensethreats requires a comprehensive email security solution that harnesses AI powered detections. Secure Email Threat Defense utilizes unique deep and machine learning models, including Natural Language Processing, in its

Related Articles