Evasion: Variation selectors in subject line

calendar Aug 28, 2026  ·
Share on: linkedin copy

Detects inbound messages where invisible Unicode variation selector characters (U+FE00–U+FE0D) are inserted immediately after alphanumeric characters in the subject line. This technique is used to break up recognizable words or phrases at the character level, allowing the text to render normally to recipients while evading keyword-based or pattern-matching detection systems.

Sublime rule (View on GitHub)

 1name: "Evasion: Variation selectors in subject line"
 2description: "Detects inbound messages where invisible Unicode variation selector characters (U+FE00–U+FE0D) are inserted immediately after alphanumeric characters in the subject line. This technique is used to break up recognizable words or phrases at the character level, allowing the text to render normally to recipients while evading keyword-based or pattern-matching detection systems."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and regex.contains(subject.base, '[A-Za-z0-9][\x{FE00}-\x{FE0D}]')  
 8attack_types:
 9  - "Spam"
10  - "Credential Phishing"
11  - "BEC/Fraud"
12tactics_and_techniques:
13  - "Evasion"
14detection_methods:
15  - "Content analysis"
16id: "39779945-7b08-5240-a9c6-bb55fb57c064"
to-top