15 Image Tiles, Zero Text: A Callback Lure With Empty OCR

Open the HTML of this message and you find 15 images and nothing else. No paragraph, no link, no button. Render the same message and you get a polished order confirmation with two line items, a grand total and a phone number printed twice.

Same email. Two completely different documents, depending on whether you read the markup or look at the screen.

It landed at an analytics and AI services company, sent from a free outlook[.]com mailbox that had never contacted the organization before. The platform's extraction fields for the message were all empty: links, QR codes and OCR text. The thing a scanner reads and the thing a person sees shared almost no content.

The page was cut into 15 pieces

The body was a stack of inline image references, fifteen in total, each pointing at an embedded content part. They sat inside nested tables marked as presentation layout, with percentage-based column widths and font-size:0; line-height:0 on every cell and div. That styling removes the gaps a browser would normally draw between pieces, so the tiles butt together and read as one seamless page.

Every one of the 15 images carried the same alt text: tdmkn.bne.4yd. That string means nothing. It is not a filename, not a description, not a word. Real order emails from real retailers either describe their images or leave alt blank on decorative slices. A uniform run of identical gibberish across a full set of tiles points to a template that was generated, not designed.

The content-ID of each tile was stamped with the recipient's mailbox name, which is a personalization detail rather than something a reader would ever see. We are not reproducing those identifiers here.

The result is a message with zero text nodes and zero anchors. Nothing to match against, nothing to click, nothing to follow.

What the platform record shows, and what it does not

The incident record shows links, ocrs and qrs all empty. To be precise about the claim: that describes what this platform extracted from this message. It says nothing broader about how any other engine would handle it, and we did not test the tiles individually or establish where in the picture the number sits.

What the record does establish is the gap. The rendered face showed an order page branded as a major online retailer, two Apple gift card lines at $500 each, and a subtotal and grand total of $500. It said the order could not be altered online and gave one contact instrument, a phone number. That is a callback lure, mapped to T1566 Phishing with the voice sub-technique T1566.004, plus T1027 for the obfuscated construction.

The construction is the point. A callback lure does not need a link, so nothing is lost by cutting the page into tiles. The only thing that has to survive is the picture the victim sees.

The lure also fails its own arithmetic

Two $500 lines do not produce a $500 total. The subject line told the reader their delivery was on the way, while the body described a gift card order that is delivered by email. The greeting was a generic "Dear Customer" even though the subject addressed the recipient by first name.

These are real tells, and a careful human reader might catch them. They are supporting detail, though. A defender cannot write a rule against bad arithmetic in a picture that no engine has read.

Authentication gave no help either. SPF, DKIM, DMARC and compauth all passed, with an SCL of 1, because Microsoft consumer mail was authenticating its own free mailbox. The message arrived in the inbox looking routine.

Structure is the signal

If extraction returns nothing, stop reading content and start reading construction. For this message the useful questions were all answerable from the HTML alone:

• How many image references does the body hold, and does any text accompany them?
• Is the alt text identical across all of them?
• Is every cell zeroed out for font size and line height?
• Does the message contain a single anchor?

Fifteen images, one repeated alt string, zeroed typography and no anchor is not a pattern legitimate commerce email produces. It is also stable. The attacker can change the number, the brand and the amounts in an afternoon. Rebuilding the tiling is a larger change.

Themis does not depend on any single extracted field. Here it rated the message with a confidence of 59 and a VIP Recipient label, and the case turned on the recipient's report and a human verdict. The user flagged the message as spam, an analyst approved the incident as malicious, and the mailbox was quarantined.

A secure email gateway that grades text, links and reputation has very little to grade on a message like this. IRONSCALES platform data shows SEGs miss an average of 67.5 phishing emails per 100 mailboxes each month.

See Your Risk: Calculate how many threats your SEG is missing

The 2026 Verizon Data Breach Investigations Report puts phishing at 16% of initial access and the human element in 62% of breaches. A lure that asks a person to pick up the phone is aimed squarely at that second number. CISA's phishing guidance and the NIST definition of phishing both frame the technique as deception of the person, not defeat of a control, which is exactly what a page cut into tiles is built for.

Indicators

Make empty extraction a finding

Treat "images present, extracted text empty" as a state to escalate, not a pass. Add structural checks to triage: tile count, repeated alt strings, text-free bodies. Review the render when those fire, and give recipients an easy way to report. Here, the report and a human verdict did what the extraction fields could not.

For background on the broader class, see the phishing glossary entry.