Link: Unicode character obfuscation in display name with base64-encoded URL fragment

calendar Aug 3, 2026  ·
Share on: linkedin copy

Detects inbound messages where the sender's display name contains Unicode format characters (such as word joiners or invisible separators) interspersed between letters to evade text-based detection. These messages carry links whose URL fragments are unusually long (over 100 characters) and match a base64url-encoded pattern, a technique used to smuggle encoded payloads past URL scanners.

Sublime rule (View on GitHub)

 1name: "Link: Unicode character obfuscation in display name with base64-encoded URL fragment"
 2description: "Detects inbound messages where the sender's display name contains Unicode format characters (such as word joiners or invisible separators) interspersed between letters to evade text-based detection. These messages carry links whose URL fragments are unusually long (over 100 characters) and match a base64url-encoded pattern, a technique used to smuggle encoded payloads past URL scanners."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and regex.icontains(sender.display_name, '[a-z]\p{Cf}+[a-z]')
 8  and any(body.links,
 9          length(.href_url.fragment) > 100
10          and regex.contains(.href_url.fragment, '^[A-Za-z0-9_-]+={0,2}$')
11  )  
12attack_types:
13  - "Credential Phishing"
14tactics_and_techniques:
15  - "Evasion"
16  - "Social engineering"
17detection_methods:
18  - "URL analysis"
19  - "Sender analysis"
20  - "Content analysis"
21id: "8619dce9-142e-5b3a-981a-1ac58960b221"
to-top