Look-Alike Letters Hid an Investment Scam From Filters

The message that reached a retired senior leader at a nonprofit science and education institution looked like a financial newsletter having a very exciting morning. A camera emoji opened the subject line, followed by a teaser about humanoid robots walking a factory floor in Texas. The body promised footage that certain people in Washington did not expect to go public, described real machines walking, turning, and working, and pointed at a text link offering to reveal which three stocks stood to benefit. No attachment, no login page, no credential form anywhere in the chain. This was a stock-pitch scam, and nearly all of its technical effort went into making sure a content filter could not read the pitch. Underneath the legible text, most of the interesting words were not spelled the way they looked.

The same trick, applied dozens of times

Start with the subject line, where the substitution begins in the first word that matters. What rendered as Humanoid was not spelled with a Latin capital H and a Latin lowercase u. It used a Greek capital Eta and a Greek lowercase upsilon, two characters that render close enough to their Latin counterparts that no reader would pause. On its own that swap is a footnote, a variant of masquerading documented for years.

What made this send worth writing up is that the operator did it again, and again, and again. The word that read as here used a Cyrillic character in place of a Latin e. The words reading as rally, contracts, winners, millions, and factory all carried substituted glyphs. Across the subject and the body, dozens of characters had been swapped for visual twins from other Unicode blocks. Not a brand name. Not a domain. Just the ordinary vocabulary of a hard-sell investment pitch, character by character.

The result is two documents inside one message. Keyword lists and high-pressure-language heuristics scored a text that did not hold the terms they were built for, while the recipient read the fluent version the operator actually wrote. That is the whole trick, and it cost the attacker a find-and-replace pass.

Authentication was not the weak point

None of this was hidden behind broken headers. SPF passed, DKIM passed with two valid signatures (one for the sender's own subdomain, one for the marketing platform that relayed it), DMARC passed, and composite authentication returned a perfect score. The sending domain even published a DMARC policy of reject, stricter than most legitimate senders bother with.

The reason is straightforward. The operator was not spoofing anyone. They registered their own domain roughly twelve weeks before this send, behind registrar privacy protection, stood up a subdomain, pointed its mail records at a mainstream marketing-cloud platform, and sent as themselves. Every check answered the question it was designed to answer: did this domain really send this mail. Nothing in the DMARC specification claims to answer whether the domain deserves trust, and here it did not. A domain that has existed for a single quarter, registered anonymously, pushing polished financial promotions through enterprise mail infrastructure, is a risk profile authentication is structurally blind to.

The click path ran through a borrowed reputation

Every clickable element, the hero image, the text call to action, the footer buttons, even the unsubscribe link, pointed at a branded click-tracking host on the sender's own subdomain, alongside a 1x1 open-tracking pixel. That is exactly what legitimate marketing email looks like, and it is the point.

At least one of those tracked links was observed forwarding into a third-party redirect service, which carried the visitor onward to a branded stock-tip page. The redirect URL embedded the recipient's own address as a path segment, which means each click was attributable to a specific mailbox. Scanners rated the visible links clean, because a marketing tracker and a redirect service are not malicious infrastructure by themselves. What the verdict could not express is that this redirect domain already carried a documented low-reputation history. The pattern is a phishing link laundered through two layers of ordinary-looking telemetry, and the first hop tells you nothing about the destination.

See Your Risk: Calculate how many threats your SEG is missing

What actually caught it

The message was quarantined on receipt and resolved as phishing automatically, affecting a single mailbox. The signals that mattered were not authentication results, because those were flawless. They were a sending domain barely three months old, an unusual density of non-Latin characters substituted into plain English words, and multiple tracking and redirect hops including one with prior bad history. Those are compositional and relational judgments about a message, the kind of reasoning our Adaptive AI applies alongside header checks rather than after them. Character anomalies and multi-hop link behavior are also what advanced malware and URL attack protection has to evaluate at the destination, not just at the visible link.

The urgency is not abstract. The 2024 Verizon Data Breach Investigations Report measured the median time to click a phishing link at 21 seconds and put the human element in 68% of breaches. CISA phishing guidance makes the same case from the defender's side: assume the lure will be read and will be convincing.

Indicators of Compromise

Disposition: spam confidence level 6, quarantined on receipt, resolved as phishing. Payload: link-only. One mailbox affected.

MITRE ATT&CK mapping

• T1036 (Masquerading): dozens of Latin letters replaced with visually identical Greek and Cyrillic characters so rendered text and parsed text diverge.
• T1566.002 (Phishing: Spearphishing Link): the entire payload is a tracked link chain to a stock-pitch destination.
• T1583.001 (Acquire Infrastructure: Domains): a purpose-registered, privacy-shielded domain and subdomain configured to authenticate cleanly.
• T1204.001 (User Execution: Malicious Link): the scam depends entirely on the recipient clicking through the redirect chain.

See you next time

The lesson is not that look-alike characters exist. It is that one cheap substitution, repeated dozens of times in ordinary words rather than brand names, separates the document your filters read from the document your people read. Check what the characters actually are, how old the sending domain is, and where the later link hops go. Clean headers begin the question, not the answer.