The Squarespace Phish With No Brand Text to Match

The email that landed in a K-12 school district's inbox looked like a Squarespace billing notice: black header bar, the familiar interlocking logo, a subject that read "Your subscription has been expired." It warned that a domain on the account would be deactivated in two days and offered a single button, "Payment link," to fix it.

A brand-impersonation filter should have flagged it on sight. It didn't, because there was nothing for it to see. The word "Squarespace" never appeared as machine-readable text anywhere in the message. The logo was a picture. The brand name in the subject and sender fields was buried under dozens of invisible characters. And the whole thing passed SPF, DKIM, and DMARC because it was sent from a real, fully authenticated domain that happened to belong to someone else.

This is what brand impersonation looks like when the attacker has done the work to make sure automated detection has nothing to match.

Nothing to Read in the Subject Line

Start with the subject. To a human it read cleanly: Your subscription has been expired. To a parser, it was a mess. Interleaved between nearly every letter were 58 copies of a single invisible character, U+206E, "National Digit Shapes," a format character the Unicode Consortium deprecated years ago. It has no legitimate rendering purpose in email. It is invisible on screen and meaningless to a display engine, but it is very much present in the byte stream.

That is the point. A subject-line rule looking for renewal-scam phrasing, or a heuristic keyed on a brand name, reads the raw string. When "subscription" is actually su + U+206E + bsc + U+206E + ript + U+206E + ion, the keyword match fails. The word the human sees does not exist as a searchable token.

The same trick ran through the sender's display name, this time with 76 invisible characters. Rendered, it showed as "Squarespace.com." In the raw header, the brand string was shattered so completely that no contiguous "Squarespace" ever appeared for a lookalike-display-name check to catch. The authenticated envelope domain underneath was noreply@oldanopetroli[.]com. Not Squarespace, and not hidden, just never compared against a brand string that had been deliberately made unreadable.

A Logo With No Letters

The brand still had to look real to the recipient, and it did, because the Squarespace wordmark and logo were delivered as an image, not as text. IRONSCALES ran OCR against the embedded graphic and pulled the string "SQUARESPACE" straight out of the pixels. That confirmed the impersonation. But OCR is not where most brand-detection lives. DOM scanners, text extractors, and template-matching rules read markup and body text, and in the body text of this message there was no brand name to read. The one place the brand appeared legibly was the one place those scanners don't look.

That combination is the whole game. Put the brand name in an image and you defeat text-based brand matching. Fragment the brand name in the headers with invisible Unicode and you defeat string heuristics. What's left is a message that impersonates a well-known company without carrying a single scannable instance of that company's name.

A Real Domain, Fully Authenticated

The last signal attackers usually trip is sender reputation, and this campaign neutralized that too, not with a throwaway domain, but with a genuine aged one. oldanopetroli[.]com was registered in 2002. Its WHOIS record showed the DNS repointed to Cloudflare nameservers and updated the day before the message was sent, and the mail carried a DKIM selector from Alibaba's Aliyun DirectMail service. In other words, the attacker had taken control of a real, 24-year-old business domain, moved its DNS, and enrolled it in a bulk email platform.

Because the send came from infrastructure now authorized for that domain, everything aligned:

None of that makes the message legitimate. SPF, DKIM, and DMARC verify that authorized infrastructure sent the mail; they cannot tell you the domain was hijacked or that the content is a Squarespace forgery. The batch headers (an alibabak_SmtpBatch feedback ID, a one-click unsubscribe) mark this as a templated bulk send rather than hand-crafted spear phishing. The sophistication here is in evasion, not targeting. A tell the attacker left in was localization: the lure listed the amount as "43,50 EUR" with a European decimal comma and a DD/MM date, aimed at a US school district that would never see either.

Attack Chain

MITRE ATT&CK mapping: T1566.002 (Spearphishing Link), T1656 (Impersonation), T1027 (Obfuscated Files or Information), T1584.001 (Compromise Infrastructure: Domains).

Indicators of Compromise

What Was Left to Catch It

When a message strips out every content-based signal, detection has to fall back on the things the attacker cannot launder. That is exactly where this one was caught. Themis flagged the incident at 90% confidence and labeled it Credential Theft and Image-Based Attack. The second label is a direct consequence of the OCR-only logo. The "Payment link" destination on studiointech[.]net carried a malicious verdict from link reputation. The sender was a first-time external correspondent whose rendered display name claimed a brand that did not match its authenticated domain. Community signal correlated the pattern with phishing seen across other organizations. The message was automatically resolved as phishing before anyone in the district acted on it.

The lesson for security teams is that brand-detection built on reading the brand is a shrinking defense. An attacker can render the logo as an image, fragment the name with invisible Unicode, and authenticate from a domain with two decades of clean history. According to the Verizon 2024 Data Breach Investigations Report, the human element still factors into the majority of breaches, and FBI IC3 data continues to put phishing among the most-reported crime types year over year. Guidance like CISA's phishing mitigation advisory helps at the process level, but the technical gap here closes only one way: detection that weighs sender behavior, link reputation, image content, and authentication together, instead of trusting any single one. For sectors like education that run lean security teams against exactly this kind of credential harvesting, that layered, behavioral read is the difference between an inbox delivery and an auto-resolved incident.

See how many phishing emails are getting through your current filters.