Callback phishing: Zero-width character obfuscation from freemail sender

calendar Aug 5, 2026  ·
Share on: linkedin copy

Detects inbound messages sent from free email providers that contain a high volume of zero-width no-break space characters inserted before closing HTML tags, a technique used to break up and obfuscate text from content scanners. The rule also requires the presence of a phone number pattern in the message thread, consistent with callback phishing lures that rely on victims dialing a number rather than clicking a link.

Sublime rule (View on GitHub)

 1name: "Callback phishing: Zero-width character obfuscation from freemail sender"
 2description: "Detects inbound messages sent from free email providers that contain a high volume of zero-width no-break space characters inserted before closing HTML tags, a technique used to break up and obfuscate text from content scanners. The rule also requires the presence of a phone number pattern in the message thread, consistent with callback phishing lures that rely on victims dialing a number rather than clicking a link."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and sender.email.domain.root_domain in $free_email_providers
 8  and regex.icount(body.html.raw, '\x{FEFF}+</[^>]*>[a-z0-9]') >= 20
 9  and regex.icontains(body.current_thread.text,
10                      '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
11                      '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
12  )
13    
14attack_types:
15  - "Callback Phishing"
16tactics_and_techniques:
17  - "Free email provider"
18  - "Evasion"
19  - "Social engineering"
20detection_methods:
21  - "HTML analysis"
22  - "Content analysis"
23  - "Sender analysis"
24id: "6a6149e0-b4f1-5bee-81e4-96d9e6449db0"
to-top