The Fake Antivirus Invoice That Misspelled Its Way In

The receipt said the charge had already gone through. A payment of $518.68, sent to Norton 360 Deluxe, issue date Tuesday, 18 August 2026, invoice number 87_EPGP504102, wrapped in the visual furniture of a PayPal payment confirmation with a Stripe reference stapled on for good measure. The recipient was a client-facing financial advisor at a regional financial-advisory firm who had bought no antivirus subscription, for $518.68 or any other amount. That gap between the document and reality was the entire point.

There was no link in the message. Not one. The dispute path printed inside the PDF was a telephone number, which makes this a callback lure, the family of attack that survives by refusing to leave anything in the email for a scanner to judge. What makes this particular sample worth reading is not the lure. It is what the attacker did to the words.

Digits where letters should be

When the attachment was rendered and its text extracted, the instruction line came back as Please call, then a bare 9, then at, then the phone number. Further down, the dispute prompt read Don't recognize this transaction? Contact, then 8, then PayPal. Single numeric characters had been spliced into the middle of the two phrases most likely to be sitting in a content filter's rule set: the instruction to place a call, and the brand name being impersonated.

Read that as a machine and there is no call at in the document and no Contact PayPal either, because in both cases a digit sits between the two words. A rule written against either phrase finds nothing. A keyword list, a regular expression tuned to catch support-line phrasing, an optical character recognition pass that dumps text into a substring search: all of them come up empty, because the thing they were told to look for is not literally present in the document.

Read it as a human, in a hurry, scanning an invoice for a charge you did not authorize, and you see a typo. Maybe a rendering artifact. Maybe nothing at all, because your eye is already moving toward the number you intend to dial. The subject line carried the same fingerprint in a cruder form, opening with "Thank you for yur order" before a long pseudorandom reference string. That is not sloppiness. It is the same trick applied to the one field a filter is guaranteed to inspect.

Visible noise is a different bet than invisible noise

Our corpus already holds attacks built on characters you cannot see: zero-width joiners inside a subject line, invisible Unicode tag characters padding body text, byte order marks salted through a URL. Those work by hiding the disruption completely. The filter reads mangled text, the victim reads clean text, and nobody has to be persuaded of anything.

Digit injection inverts the bet. The characters here are fully visible. They render, they occupy space, and anyone reading carefully will notice them. The attacker has decided that visible corruption is an acceptable price, because a stray digit dropped into a line of invoice text is small enough that an alarmed reader skims straight past it, while it reliably defeats an exact-string match. It is also more durable: invisible characters get stripped or normalized by an increasing number of mail pipelines, and a plain ASCII digit survives every normalization pass there is. The technique maps to MITRE ATT&CK T1027, obfuscated files or information, riding on T1566.001, spearphishing attachment.

A clean authentication pass carried no information at all

The delivery was the least sophisticated part of the attack and, in its way, the most instructive. The message came from a consumer webmail account, an ordinary free mailbox carrying an unrelated individual's name in all capitals as its display name, and it authenticated flawlessly. SPF passed. DKIM passed with a signing domain matching the visible sender. DMARC passed with alignment intact. Microsoft's composite authentication returned a pass with reason 100, the strongest verdict it issues.

None of that was forged, and that is the problem. Every one of those green lights was genuine, because the mail really was sent by that provider, by that account holder, with no spoofing anywhere in the chain. Free consumer mailboxes ship with a fully aligned authentication posture as a matter of course, which means an attacker inherits perfect SPF, DKIM and DMARC results simply by filling in a signup form. Authentication answers the question "is this sender who the header claims," and here it answered correctly. It has nothing to say about whether the attached document is a fabrication. DMARC, specified today in RFC 9989, validates the alignment of the sending domain and nothing else about the message, and the 2026 Verizon Data Breach Investigations Report puts phishing at 16% of breach initial access vectors while 62% of breaches involve the human element. The technique that dominates is not the one that beats cryptography. It is the one that beats people.

The attachment scanned clean too. A 36 KB PDF, no active content, an antivirus verdict of clean, which is exactly right: there was nothing executable in it. The malicious content was a phone number and a lie about a subscription.

See Your Risk: Calculate how many threats your SEG is missing

Nothing to match, so match nothing

Strip out the signals this attack deliberately removed and look at what a conventional stack has left. No URL to reputation-check. No malicious payload for attachment and URL analysis to detonate. No authentication failure to alert on. No matching keyword string, because the strings were surgically broken. The residual detection surface is behavior, and on behavior this message was loud.

Our Adaptive AI, Themis, scored it at 90% confidence and labelled it invoice phishing, driven by content-language analysis, community reputation, and sender-behavior signals rather than any file or link signature. A first-time external sender. A consumer mailbox delivering a corporate-looking financial document to a named advisor. A subscription charge with no purchase history behind it. A telephone number positioned as the sole remedy. The message was mitigated and the incident resolved as phishing automatically, with no human triage required.

For defenders the practical guidance is narrow and worth acting on. Treat mangled text as a signal in its own right rather than a quality problem, because deliberate corruption of exactly the phrases you filter on is evidence of intent that no reputation score will hand you. Stop reading an authentication pass as a trust score. And handle "call this number about a charge you do not recognize" as its own threat class alongside vishing, since the theft happens on the call where no email control can follow. CISA's phishing guidance and the NIST definition of phishing both frame the problem as an attack cycle to interrupt rather than an artifact to block, and the 2025 FBI IC3 report records $20.877 billion in reported losses across 1,008,597 complaints, with cyber-enabled fraud accounting for 45% of complaints but 85% of the money.

Indicators of Compromise

MITRE ATT&CK Mapping

See You Next Time

An attacker who mangles a word is telling you which word your filter is watching. That is a gift, if you are set up to read it.