Attackers now pad phishing emails with real signatures and harmless text to confuse AI scanners. See how the technique works and what actually stops it.
A phishing email with no obvious tricks might still be hiding one. Attackers now pad the bottom of a malicious email with pages of harmless text. They add real links and even a familiar company’s email signature. The goal is to confuse the AI models that scan email for threats, not the person reading it. Spotting this means looking past the message you see, to the one hiding beneath it.
So modern email security does not just match known bad senders. It reads the words in a message. Then it scores how likely they are to signal a scam. This is natural language processing, or NLP. It is why a poorly worded phishing email often gets caught before a person ever sees it.
The scoring works on balance. A message full of threat words, such as “urgent,” “verify,” and “suspended,” scores as risky. A message full of ordinary, calm language scores as safe. Attackers found the lever hiding in plain sight. Add enough safe-sounding content, and the average pulls the whole message toward safe.
For this NLP obfuscation technique, security researchers studied the underlying pattern. They found a consistent two-part structure in the emails that use it.
| Part | What it contains | Purpose |
|---|---|---|
| Top section | The actual phishing attempt | What the attacker wants you to act on |
| Separator | Dozens or hundreds of blank line breaks | Pushes the real content out of easy view |
| Bottom section | Real company signatures, real links, filler text | Confuses the scoring system |
Egress’s threat intelligence unit first flagged the pattern, and KnowBe4, which owns Egress, later republished the same analysis of 40 recent attacks. They found that links to well-known brands were the most common padding, alongside random characters and copied email threads. A real Bank of America email signature was the most frequent append. On average, a padded email carried roughly five real links against about two malicious ones.
The blank-line separator matters as much as the padding itself, a cousin of the technique behind modern phishing kits that ship ready-made evasion features. By pushing the hidden part far enough down, the attacker bets the recipient will never scroll that far. Meanwhile, the scanning system still has to read the whole message to compute a score.
Discover how Threatcop protects your workforce from modern cyber threats.
The NLP obfuscation technique exploits a real tradeoff in how these systems work. A scanner has to read the entire email to understand its content. So more content takes more time. Some security tools release a message if scanning takes too long, rather than hold up delivery forever. A deliberately bloated email can cross that threshold. It gets released before a full verdict is reached.
It also exploits volume over precision. Stacking five benign links against two malicious ones shifts the average. No single part has to be deceptive on its own. The system is not wrong about any single part. It is wrong about what the parts add up to.
This is not an isolated trick. Separate research from Egress found that most malicious emails combined two or more obfuscation methods at once. So this technique rarely travels alone.
A security team cannot fix this by reading harder. The fix has to change what the system looks at, and how it decides.
NLP obfuscation targets software, not people. So employee training does not need to change its core message. If a phishing email reaches an inbox because it beat a scanner, it still looks like a phishing email once a person reads it.
What matters is that staff do not assume length or extra content equals legitimacy. A message that trails off into an unrelated company’s marketing footer, right after the real request, is itself worth a second look. Most people will never scroll that far to see it.
Reporting still closes the loop that detection alone cannot. A human reading the top of the email sees the same attempt a machine was tricked into scoring as safe.
Technical evasion tricks like this one are exactly why detection alone was never enough. Threatcop Security Awareness Training (TSAT) builds the habit that catches what automated filters let through, since a person judging intent does not get fooled by padding the way a scoring model can.
Its simulations test the judgment call directly. They present realistic lures without relying on the message ever first failing a technical filter. Average breach time, meaning how long from lure to compromise, and the Employee Vulnerability Score both measure whether that judgment is actually improving. A clean filter history alone does not prove a trained workforce. Repeat-offender identification then points coaching at the people who need it, instead of treating every employee the same after one evasive email gets through.
NLP obfuscation succeeds by exploiting a tradeoff detection systems cannot fully escape. More content takes more time to analyze, and averaging risk across a longer message dilutes a real threat sitting at the top of it. Fixing the scoring model helps, but it will not be the last evasion trick attackers find. One thing stays constant across every version of this problem. It is a person who reads the actual request, notices it does not add up, and reports it before anyone acts on it.
NLP obfuscation pads a phishing email with large amounts of harmless text, real links, and real signatures. The goal is to confuse AI-based email filters that score messages by their language. The overall message looks safe on average, even though the top of it is malicious.
Real signatures and links from well-known brands rarely appear on any email security blocklist. So including them adds content the scanning system trusts. Researchers found Bank of America’s email signature was the most common choice. It is instantly recognizable and never flagged as suspicious on its own.
NLP obfuscation targets natural language processing detection specifically, since that is the whole point of the technique. That capability is more common in integrated cloud email security tools than in traditional gateways. Tools relying mainly on sender and link reputation are less affected, though they may miss the same emails for other reasons.
No, but it shows that scoring by average content risk has a real weakness. The fix is better scoring. That means flagging unusual structure and refusing to auto-release delayed scans, not dropping AI-based detection altogether.
Do not assume a long or polished email is automatically safe. Report anything that asks for credentials, payment, or urgent action, no matter how clean the rest of the message looks. A blame-free reporting culture matters most here, since the email reached the inbox by design, and someone still has to flag it.
Shikha Mishra is responsible for driving the growth and adoption of TDMARC, a flagship product of Threatcop, across India, the Middle East, APAC, and the UK region. With her expertise, she helps organizations safeguard their domains so that no hacker can misuse them to send fraudulent emails, thereby protecting both their brand and reputation. She is passionate about enabling businesses to simplify the complexities of outbound email security through TDMARC’s comprehensive solution, allowing them to stay focused on what matters most to their success.
Adaptive email security judges behavior continuously, not just at delivery. See the real Gartner model behind it, its limits,...
Secure email gateways cannot catch the wrong-John problem. See why financial firms are adding behavior-based email security, and what...
S/MIME, Microsoft 365 Message Encryption, and password-protected files all work differently. See which one to use and how to...
