Hello and welcome to the Wednesday, October 29th, 2025 edition of the Sands Internet Storm Center's Stormcast.

My name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the Sands.edu credit certificate program in cloud security.

Well, in Diaries today, we got an interesting new fishing trick that Jan wrote about.

It involves invisible characters in the subject of the email.

Now, the trick has been quite common in the body of the email,

where it's being used to break up words that are often being used to trigger span filters,

but now attackers are also using it in the subject line,

probably for the same reason.

Here, the subject as seen by the user is your password is about to expire.

So a classic fishing subject line that, of course, may get blocked by common fishing filters,

but here the attacker is then inserting invisible characters.

Now, strictly speaking, the characters being used here are not really invisible.

One, for example, that Jan observed here is the soft hyphen, which should still be displayed as a

hyphen, but many email clients, like, for example, Outlook in this example, do not display them

as part of the subject of an email,

so they basically just disappear.

And that's sort of how they're bypassing these filters.

You cannot just look for, hey, are they using some odd spaces

or things like this?

But you also have to look for characters that

may be legit in some contexts, but are here just used to break up the text.

...