Callback phishing: Zero-width character obfuscation from freemail sender

name: "Callback phishing: Zero-width character obfuscation from freemail sender"
description: "Detects inbound messages sent from free email providers that contain a high volume of zero-width no-break space characters inserted before closing HTML tags, a technique used to break up and obfuscate text from content scanners. The rule also requires the presence of a phone number pattern in the message thread, consistent with callback phishing lures that rely on victims dialing a number rather than clicking a link."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and sender.email.domain.root_domain in $free_email_providers
  and regex.icount(body.html.raw, '\x{FEFF}+</[^>]*>[a-z0-9]') >= 20
  and regex.icontains(body.current_thread.text,
                      '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
                      '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
  )
  
attack_types:
  - "Callback Phishing"
tactics_and_techniques:
  - "Free email provider"
  - "Evasion"
  - "Social engineering"
detection_methods:
  - "HTML analysis"
  - "Content analysis"
  - "Sender analysis"
id: "6a6149e0-b4f1-5bee-81e4-96d9e6449db0"