When the Sender Name Is Not Even the Same Alphabet

The mailbox belonged to a staff member at a US precision manufacturing company, and for the length of one glance the message in it looked like an official notice from the Social Security Administration. The display name said so. The subject line, tagged [EXTERNAL] by the recipient's own gateway, read "Time to Access Your Benefits Information." Almost everything underneath that was wrong, and almost none of it was wrong in a way an authentication check can see. SPF passed. DKIM passed twice. DMARC passed. Microsoft's composite authentication returned a pass with reason 100. The case was resolved as phishing anyway, and why it was resolved as phishing is more interesting than the lure.

The display name was spelled in two alphabets

The trick sat in the From header, and that location matters more than it sounds. A From header is a raw RFC 5322 field. It carries no stylesheet, no CSS, no font substitution, no hidden-element sleight of hand. Whatever distortion appears in a display name has to be encoded in the characters themselves. So when the rendered name looked like the agency's title but did not match the agency's title as a string, there was exactly one available explanation: the characters were not the characters they appeared to be.

Four Latin letters had been replaced with Cyrillic look-alikes. Every o, every a, every e, and every i in the phrase came from a different script. Rendered in a mail client at normal size, the substitutions are invisible to a reader. Compared byte for byte against a brand watchlist, the phrase shares almost nothing with the real thing. This is masquerading in the service of impersonation, and it defeats the cheapest control in the stack: exact-string matching on high-value sender names.

The consequence worth sitting with is not that a filter missed it. It is that a filter could not have caught it that way. A blocklist of protected display names is a list of byte sequences, and a homoglyph swap produces a fresh byte sequence for every combination of substituted letters. In a phrase this long there are dozens of plausible combinations, and no list enumerates them. Normalization has to happen before comparison, or the comparison is theater.

Authentication proved custody, not authority

The sending address was a role mailbox on a privacy-protected personal domain that had been registered in 2014, roughly a decade before this message went out, through ENOM and pointed at Cloudflare nameservers. It has no relationship to the agency being impersonated. It is not a lookalike of the agency's domain either, so lookalike detection had nothing to grip. And it is not new, so domain-age heuristics had nothing to say about it.

The message was relayed through Amazon SES out of the eu-west-1 region, and it was relayed legitimately. That is why the results are clean. SPF passed for the sending domain, DKIM validated for both that domain and the relay, and DMARC therefore found alignment. Worth noting for what it implies: signing successfully for the sending domain means whoever sent this had enough control over that domain's DNS to complete the relay provider's verification flow. Everything the standard asks for was satisfied.

Read RFC 7489 closely and this stops being surprising. DMARC verifies that the domain in the From address is authorized to send, and nothing beyond that. It holds no opinion on the human-readable phrase in front of the address, which is the only part most people ever read. A domain can carry a flawless DMARC posture and still be used to claim, in the one field a recipient actually looks at, that it belongs to a federal agency. Authentication is a statement about custody of a domain. It is not a statement about identity.

See Your Risk: Calculate how many threats your SEG is missing

Two brands in one body, and neither was the sender

The HTML body was thin. A short reference to benefits information, no personalization of any kind, no salutation naming the recipient or the company, and no visible link or button in the retrievable content. What it did contain was a branding collision. The markup referenced an embedded image placeholder for an Adobe logo, and sitting near it in visible bold text was the word Microsoft. Neither brand has anything to do with the impersonated agency, and the two do not belong together.

That is the signature of a reused template. Somebody assembled this body from a kit built for a different campaign, swapped the display name, and shipped it without cleaning out the artifacts. The mismatch is not clever evasion. It is debris. Debris is useful, because internal inconsistency is exactly the sort of thing a behavioral model reads as intent even when every header check comes back green.

That is what happened here. The incident was resolved automatically as phishing, not because one indicator failed, but because the relationship between the indicators would not hold together: a first-contact sender, a federal-agency display name, an unrelated apex domain, a body carrying two unrelated consumer brands, and no legitimate business reason for any of it to reach a manufacturing mailbox. Adaptive AI scores that combination as a whole. Not one signal in it is disqualifying on its own.

What defenders should take from a payload-free lure

There was no attachment and no clickable destination in what could be retrieved, which makes this message easy to underrate. Treat it as an opening move instead. A payload-free, unpersonalized send that survives authentication is a cheap way to test whether a mailbox is live, whether a spoofed display name survives the gateway untouched, and whether a mixed-script phrase gets rewritten or flagged in transit. The reply, or the click on the follow-up, is where the loss lands.

The 2024 Verizon Data Breach Investigations Report puts the human element in 68% of breaches and phishing in 15% of them, and it measures the median time to click a phishing link at 21 seconds. Twenty-one seconds is less time than it takes to compare two alphabets. The 2024 IBM Cost of a Data Breach Report puts the global average breach cost at $4.88 million, which is the price of the follow-up nobody caught. Government-benefit pretexts earn their place in that funnel because they arrive with borrowed authority and manufactured urgency, and they work on personal anxiety rather than business process, which is why they reach corporate mailboxes at manufacturers as readily as anywhere else.

Three controls actually bite on this class of message. First, normalize display names to a single script before comparing them against protected-brand lists, and alert on mixed-script names outright, because a legitimate sender almost never needs two alphabets in one phrase. Second, stop treating an authentication pass as a trust signal about who the sender is, which is the framing in both CISA's phishing guidance and the NIST definition of phishing: the attack is a deception problem, not a delivery problem. Third, score the internal coherence of a message, because the branding collision was the loudest thing in this one and no header check would ever have seen it.

Indicators of Compromise

MITRE ATT&CK Mapping