The rapid growth of online communication has increased the demand for secure communication. Most government entities, healthcare providers, the legal sector, financial and banking, and other industries are vulnerable to information security issues. Text steganography is one way to protect secure communication by hiding secret messages in the cover text. Hiding a large amount of secret information without raising the attacker’s suspicion is the main challenge in steganography. This paper proposes the Color and Spacing Normalization stego (CSNTSteg) model to resolve the low capacity and invisibility problems in text steganography. CSNTSteg consists of two stages: the pre-embedding stage, which achieves high capacity by utilizing RGB coding and character spacing. It is designed to increase the number of bits per location and usable characters. Besides, it applies the Huffman coding technique to compress the secret message to add more capacity enhancement. The second stage is color and space normalization, which accomplishes high invisibility by normalizing the RGB coding and character spacing of the cover and stego text. CSNTSteg overcomes the color difference issue between the cover and stego texts regardless of the color of the cover text. To assess the quality of CSNTSteg, the experimental results are compared with existing works. CSNTSteg shows superior capacity over the existing studies with a percentage of 98.85%. CSNTSteg also achieves high invisibility by reducing the color difference with a percentage of 4.7% and 5.07% for black and colored cover text, respectively. Furthermore, CSNTSteg improves robustness by 94.22% by reducing the distortion in stego text. Overall, the CSNTSteg model embeds a high capacity of secret data while maintaining invisibility and security, offering a new perspective on text steganography to protect against visual and statistical attack issues.

Protecting sensitive information transmitted via public channels is a significant issue faced by governments, militaries, organizations, and individuals. Steganography protects the secret information by concealing it in a transferred object such as video, audio, image, text, network, or DNA. As text uses low bandwidth, it is commonly used by Internet users in their daily activities, resulting a vast amount of text messages sent daily as social media posts and documents. Accordingly, text is the ideal object to be used in steganography, since hiding a secret message in a text makes it difficult for the attacker to detect the hidden message among the massive text content on the Internet. Language’s characteristics are utilized in text steganography. Despite the richness of the Arabic language in linguistic characteristics, only a few studies have been conducted in Arabic text steganography. To draw further attention to Arabic text steganography prospects, this paper reviews the classifications of these methods from its inception. For analysis, this paper presents a comprehensive study based on the key evaluation criteria (i.e., capacity, invisibility, robustness, and security). It opens new areas for further research based on the trends in this field.

In multilingual communication, dialectal differences, code-switching, and culturally influenced persuasive approaches make phishing and social engineering attacks more widespread, testing existing detection technologies. Traditional monolingual and multilingual transformer-based methods concentrate on lexical and semantic similarities and are less resistant to paraphrase or translation-induced semantic changes. TRIDENT-SE (Translation-Divergence and Intent Graph-based Detection of Social Engineering) is a hybrid cross-lingual cyber threat detection system that uses massive language models and graph-based behavioral reasoning. An instruction-tuned Large Language Model contextualizes English, Modern Standard Arabic, regional Arabic dialects, and romanized Arabic phrases. TDE modules assess semantic differences between original and translated messages, enhancing translation noise and language change resilience. An Intent–Action Graph Reasoning (IAGR) module simulates attacker strategies by correlating urgency, impersonation, credential solicitation, authority exploitation, and money demands. TRIDENT-SE increases F1-score by 9.4% over monolingual baselines and 5.1% over state-of-the-art multilingual transformer models in code-switching, dialect-shift, and adversarial paraphrase situations on an annotated Arabic–English dataset. Arabic-speaking human-centered evaluation participants had 18.7% more correct risk assessments and 22.3% less harmful user responses. Multilingual phishing and social engineering detection is robust and interpretable using translation-aware semantic analysis and intent-driven graph learning.