New Phishing Attack Using Invisible Characters Hidden in Subject Line Using MIME Encoding

Security researchers have uncovered a phishing technique that hides invisible Unicode characters in email subject lines by abusing MIME encoding. The subject line uses RFC 2047 MIME encoded-word formatting, with two encoded-word segments carrying UTF-8 data processed through Base64, revealing multiple soft hyphen characters (Unicode code point U+00AD) when decoded.

These soft hyphens render as invisible in most clients, such as Outlook, allowing the message to appear normal to recipients while evading automated filters. The attackers combine MIME encoding with soft-hyphen insertion across multiple segments to fragment potentially malicious keywords and bypass signature-based rules, directing victims to a credential-harvesting webmail login page hosted on a compromised domain.

This technique underscores a blind spot in email security, as subject-line scrutiny has received less granular examination than body content, and researchers urge organisations to review Unicode character detection across subject lines and bodies, according to isc.sans[.]edu. The piece, authored by Mayura Kathir, was published on 28 October 2025.