Invisible Characters, SIM Swap Jail Time, and a $10 Million Bounty: This Week's Security Briefing

Key points

• Attackers are hiding malicious text inside emails using invisible Unicode characters, allowing phishing messages to slip past automated filters undetected.
• The US government is offering a $10 million reward for information leading to an Iranian cyber official with alleged ties to state-sponsored hacking campaigns.
• A SIM swapper, meaning a criminal who tricks phone carriers into transferring a victim's number to a device the criminal controls, has been sentenced in the United States.
• Researchers at security firm Glasswing have published findings on the Chinese hacking group known as QTFY, including evidence of military connections.

What is the invisible-character trick, and should ordinary people worry?

Yes, a little. Researchers have documented an attack method called InjectEave, where criminals hide instructions inside emails using invisible Unicode characters. Unicode is the global system that assigns a code to every letter and symbol across every language, and some of those codes produce characters that are completely invisible on screen. We first covered this technique on 4 September, when Microsoft told reporters that attackers were splitting bait words like 'funding' with unprintable Unicode tags so security scanners never see them.

A spam filter reads the email, sees what looks like harmless text, and waves it through. The malicious content sits hidden in gaps the filter never examines. MFA, meaning multi-factor authentication where you confirm your identity with a second step such as a code sent to your phone, won't stop a phishing email from arriving. It would, however, limit the damage if you were tricked into handing over your password, since the criminal would still need that second factor.

If you receive an unexpected email urging you to click a link or log in somewhere, go directly to the website by typing its address yourself.

Who is the SIM swapper, and what did they do?

A court in the United States has sentenced a SIM swapper. SIM swapping works like this: a criminal contacts your mobile carrier, pretends to be you, and convinces the carrier to move your phone number onto a SIM card the criminal owns. Your calls and text messages, including one-time login codes from banks and apps, then go to the criminal instead.

This case is a reminder that SMS-based two-factor authentication is genuinely weaker than an authenticator app, which generates codes locally on your own device and can't be intercepted by a SIM swap.

What is the $10 million bounty about?

The US government has offered a $10 million reward for information about an Iranian official allegedly connected to state-backed hacking operations. Bounties at this scale, run through the State Department's Rewards for Justice programme, typically target groups that go after critical infrastructure such as hospitals and power utilities. The same SecurityWeek roundup flagged Glasswing's findings on the QTFY group, which linked the Chinese hacking operation to military structures. We've tracked QTFY since 2 September, including the FBI's seizure of shared attack infrastructure used against NASA and the Federal Reserve, and those military ties do change the calculus: this isn't criminal-for-hire activity with plausible deniability, it's something harder to dismiss.