The zero-font tactic is a method employed in phishing emails to evade spam filters and trick recipients. In this strategy, cybercriminals use a technique where they insert hidden text or characters (usually in white or a color matching the background) within the body of an email. These hidden characters are often tiny and placed in areas where the recipient wouldn't typically notice, like the spaces between words or within the HTML code.

The purpose of these hidden characters is to confuse the email filters by making the email appear different to automated scanning systems than it does to human eyes. By using zero-font characters, the email can contain potentially malicious content or links that remain hidden from casual observation but can be read and activated by the email client or browser.

This tactic is an attempt to bypass spam filters that usually scan the visible content of an email to identify phishing attempts or malicious links. However, many modern email security systems have evolved to detect and block such deceptive tactics by analyzing the entire content of an email, including hidden elements, to identify suspicious patterns or content.

The other method uses zero-font text to add words to the email's text preview. If you open up your email provider's software or website, you'll likely see that the emails in your inbox show three pieces of data: the sender, the topic, and then a preview of the start of the email, so you know what the email is about.

Because this preview is generated via the HTML code, hackers can add zero-font text to the start of the email, which will show up in the preview. However, when the victim clicks on the email, the text is nowhere to be seen.

One particularly nasty way scammers used this tactic was reported on the SANS Internet Storm Center. In this example, the scammer wrote a fake result from an antivirus scan and added it to the top of the email in zero-font text.

When the email arrived in the victim's inbox, the email preview displayed the fake scan result and gave the victim a false sense of security that the links within the email had been scanned and found to contain no viruses. When the victim then opens the email, the zero-font text vanishes from view, leaving only the scammer's advertisement in its place.