Executive Summary
In mid-June 2026, a sophisticated phishing attack targeted a sales representative at a medical device manufacturer, successfully achieving a full DMARC pass despite a lack of authorized SPF hosts. The attacker leveraged a legitimate but compromised media company domain in Botswana to send the message, utilizing an aligned DKIM signature to bypass standard authentication checks.
The technical core of the evasion involved interleaving seven junk ASCII characters within the Call-to-Action (CTA) button text. These characters were wrapped in inline HTML tags (e.g., `<sup>`, `<tt>`) and styled with CSS to have near-zero width and hidden overflow. This caused security scanners to read garbled text while human recipients saw a clean, professional lure. The landing page was hosted on an eleven-year-old Malaysian corporate domain, further complicating reputation-based blocking.
This incident highlights a critical weakness in relying solely on DMARC pass results and string-based anchor text matching. Organizations must look for asymmetries between DKIM and SPF records and implement detection capable of identifying hidden CSS-based character manipulation within email bodies.