{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Adversaries are repurposing AI prompt injection techniques for traditional phishing evasion. These invisible characters successfully bypass keyword-based filters; detecting this crossover tradecraft provides high-fidelity signals for active fraud campaigns targeting financial assets."
      },
      "name": "Unicode-Smuggling Financial Phishing Evasion",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1566",
        "attack.t1090.003"
      ],
      "related": [
        {
          "hunt": "homoglyph-phishing-domains",
          "reason": "That hunt focuses on visually similar characters in domain names, whereas this hunt focuses on invisible smuggling characters inside keywords.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "Simple keyword rules fail when terms like funding are split by invisible characters. This hunt pivots across DNS, HTTP, and Network prevalence to confirm the presence of percent-encoded smuggling markers that would be otherwise ignored by static signatures.",
      "coverage": [
        {
          "stage": "phishing-campaign-delivery",
          "steps": [
            "dns-campaign-lead"
          ],
          "status": "covered"
        },
        {
          "stage": "keyword-obfuscation-evasion",
          "steps": [
            "http-smuggling-check"
          ],
          "status": "covered"
        },
        {
          "stage": "multi-hop-proxy-redirection",
          "steps": [
            "network-connection-pivot"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Phishing Campaign Delivery",
            "slug": "phishing-campaign-delivery",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "guardiangrowthfunding.com",
              "digitalcapitalboost.com",
              "thebusinessloanexpress.com",
              "yourlocfunding.com",
              "ActiveCampaign infrastructure",
              "Financial lures regarding business loans or line-of-credit"
            ]
          },
          {
            "name": "Keyword Obfuscation via ASCII Smuggling",
            "slug": "keyword-obfuscation-evasion",
            "tactic": "defense-evasion",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "Unicode tag characters range U+E0000 to U+E007F",
              "Invisible TAG SPACE U+E0020",
              "Split keywords like 'f<U+E0020>unding'",
              "Invisibility in human-facing UI while appearing to machine parsers"
            ]
          },
          {
            "name": "Multi-hop Proxy Redirection",
            "slug": "multi-hop-proxy-redirection",
            "tactic": "command-and-control",
            "techniques": [
              "T1090.003"
            ],
            "observables": [
              "Disposable finance-themed domains",
              "Multi-hop proxy infrastructure to disguise traffic source"
            ]
          }
        ],
        "summary": "A high-volume phishing campaign leveraged invisible Unicode tag characters (ASCII Smuggling) to split financial keywords such as 'funding' in email lures, successfully evading literal keyword filters and NLP-based tokenizers. The campaign utilized over 150 finance-themed domains and followed a strict weekday-only cadence for three months starting in February 2026."
      },
      "severity": "high",
      "rationale": "Targets hosts with Office/M365 installed as primary candidates for email-based phishing interactions. The hunt assumes these hosts are the most likely to be targeted with business-finance lures.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary is using invisible Unicode tag characters to split keywords in finance-themed phishing lures, bypassing traditional email filters and redirecting victims to disposable infrastructure.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Hosts with Microsoft 365 or Office installed, identified in the scoping step."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "campaign_domains": {
          "from": {
            "ref": "msrc-blog-ascii-smuggling",
            "kind": "article",
            "observed": "2026-09-03"
          },
          "type": "list[domain]",
          "default": [
            "guardiangrowthfunding.com",
            "digitalcapitalboost.com",
            "thebusinessloanexpress.com",
            "yourlocfunding.com"
          ],
          "description": "Disposable finance-themed domains identified in the campaign."
        },
        "encoded_tag_prefix": {
          "type": "string",
          "default": "%f3%a0",
          "description": "The percent-encoded UTF-8 prefix for characters in the Unicode Tags block."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/",
          "name": "MSRC Blog \u2014 ASCII smuggling crosses over from AI prompt injection to phishing evasion"
        }
      ],
      "blind_spots": [
        {
          "id": "no-dns-logging",
          "risk": "The lead query would fail to find the initial interaction, stopping the hunt at the gate.",
          "stage": "phishing-campaign-delivery",
          "question": "whether the host resolved a campaign domain using DoH or an unmonitored resolver",
          "requires": "Endpoint DNS resolution logging"
        },
        {
          "id": "no-http-proxy",
          "risk": "Encrypted traffic without proxy-level inspection prevents visibility into the percent-encoded smuggling markers in URL paths or referrers.",
          "stage": "keyword-obfuscation-evasion",
          "question": "whether the smuggling markers were present in encrypted HTTPS traffic",
          "requires": "hb_http_activity with full URL/Referrer capture"
        }
      ]
    },
    "name": "Unicode-Smuggling Financial Phishing Evasion",
    "description": "This hunt identifies the use of ASCII smuggling characters (U+E0000 to U+E007F) within phishing campaigns targeting financial departments. By inserting invisible TAG characters into lure words like funding, attackers evade literal keyword matching and modern NLP-based classifiers. The hunt uses a gated flow to first identify interactions with campaign-specific domains before performing a deep dive into HTTP headers for percent-encoded smuggling markers and corroborating the activity with network connection patterns that suggest multi-hop redirection."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "phishing-campaign-delivery",
            "steps": [
              "dns-campaign-lead"
            ],
            "status": "covered"
          },
          {
            "stage": "keyword-obfuscation-evasion",
            "steps": [
              "http-smuggling-check"
            ],
            "status": "covered"
          },
          {
            "stage": "multi-hop-proxy-redirection",
            "steps": [
              "network-connection-pivot"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary is using invisible Unicode tag characters to split keywords in finance-themed phishing lures, bypassing traditional email filters and redirecting victims to disposable infrastructure.",
        "blind_spots": [
          {
            "id": "no-dns-logging",
            "risk": "The lead query would fail to find the initial interaction, stopping the hunt at the gate.",
            "stage": "phishing-campaign-delivery",
            "question": "whether the host resolved a campaign domain using DoH or an unmonitored resolver",
            "requires": "Endpoint DNS resolution logging"
          },
          {
            "id": "no-http-proxy",
            "risk": "Encrypted traffic without proxy-level inspection prevents visibility into the percent-encoded smuggling markers in URL paths or referrers.",
            "stage": "keyword-obfuscation-evasion",
            "question": "whether the smuggling markers were present in encrypted HTTPS traffic",
            "requires": "hb_http_activity with full URL/Referrer capture"
          }
        ],
        "scoping_notes": "Targets hosts with Office/M365 installed as primary candidates for email-based phishing interactions. The hunt assumes these hosts are the most likely to be targeted with business-finance lures.",
        "beyond_detection": "Simple keyword rules fail when terms like funding are split by invisible characters. This hunt pivots across DNS, HTTP, and Network prevalence to confirm the presence of percent-encoded smuggling markers that would be otherwise ignored by static signatures."
      }
    },
    {
      "id": "scoping-office-hosts",
      "type": "query",
      "label": "Identify hosts with Office software",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%microsoft 365%' OR LOWER(package_name) LIKE '%office%') GROUP BY device_hostname, package_name, package_version",
        "surface": "hb_software_inventory",
        "description": "Focus the hunt on endpoints running software typically used for processing the phishing lures described in the research.",
        "expected_signal": "A list of hostnames. Since this is an inventory snapshot, silence means no matching software was found on the monitored fleet."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify hosts with Office software",
        "reads": [
          "device_hostname",
          "package_name",
          "package_version"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%microsoft 365%' OR LOWER(package_name) LIKE '%office%') GROUP BY device_hostname, package_name, package_version",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames. Since this is an inventory snapshot, silence means no matching software was found on the monitored fleet.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "dns-campaign-lead",
      "type": "query",
      "label": "DNS hits on campaign domains",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, query_hostname, COUNT(*) as lookup_count, MIN(time) as first_hit, MAX(time) as last_hit FROM hb_dns_activity WHERE (instr(',' || '{{campaign_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname ORDER BY lookup_count DESC",
        "surface": "hb_dns_activity",
        "description": "Identify hosts that have interacted with the known campaign infrastructure as a primary lead.",
        "expected_signal": "Any hostname resolving the campaign domains is a lead. Silence suggests no direct interaction with the known IOC list occurred via monitored resolvers."
      },
      "parents": [
        {
          "id": "scoping-office-hosts"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "DNS hits on campaign domains",
        "reads": [
          "device_hostname",
          "query_hostname",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, query_hostname, COUNT(*) as lookup_count, MIN(time) as first_hit, MAX(time) as last_hit FROM hb_dns_activity WHERE (instr(',' || '{{campaign_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname ORDER BY lookup_count DESC",
        "silence": "not_evidence_of_absence",
        "expected": "Any hostname resolving the campaign domains is a lead. Silence suggests no direct interaction with the known IOC list occurred via monitored resolvers.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "evaluate-lead",
      "type": "analytic",
      "label": "Evaluate DNS lead",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network",
          "web"
        ],
        "context": [
          "dns-campaign-lead"
        ],
        "objective": "Determine if the DNS lookups in dns-campaign-lead represent a suspicious interaction with confirmed campaign domains.",
        "description": "Analyze the DNS activity to determine if a host shows meaningful interaction with the campaign infrastructure to justify deeper inspection.",
        "max_iterations": 3,
        "expected_signal": "A verdict on whether to proceed based on the DNS lookup volume and timing.",
        "success_criteria": "A per-host verdict of suspicious or benign."
      },
      "parents": [
        {
          "id": "dns-campaign-lead"
        }
      ]
    },
    {
      "id": "gate-on-lead",
      "type": "checkpoint",
      "label": "Gate on lead verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the evaluate-lead verdict identifies at least one host with suspicious domain resolutions",
        "condition": "the evaluate-lead verdict identifies at least one host with suspicious domain resolutions",
        "blind_spot": "no-dns-logging",
        "confidence": "high",
        "description": "Only open expensive inspection queries for hosts that have already shown signs of campaign interaction.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "evaluate-lead"
        }
      ]
    },
    {
      "id": "http-smuggling-check",
      "type": "query",
      "label": "HTTP smuggling check",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "web",
        "content": "SELECT device_hostname, url_hostname, url_full, referrer, user_agent, time FROM hb_http_activity WHERE (LOWER(url_full) LIKE '%' || '{{encoded_tag_prefix}}' || '%' OR LOWER(referrer) LIKE '%' || '{{encoded_tag_prefix}}' || '%') AND (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Identify HTTP requests where the URL or referrer contains the specific percent-encoded prefix for Unicode tag characters.",
        "expected_signal": "A hit identifies the presence of the smuggling block in transit. This is a very rare and high-fidelity indicator of evasion tradecraft."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "HTTP smuggling check",
        "reads": [
          "device_hostname",
          "url_hostname",
          "url_full",
          "referrer",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_hostname, url_full, referrer, user_agent, time FROM hb_http_activity WHERE (LOWER(url_full) LIKE '%' || '{{encoded_tag_prefix}}' || '%' OR LOWER(referrer) LIKE '%' || '{{encoded_tag_prefix}}' || '%') AND (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A hit identifies the presence of the smuggling block in transit. This is a very rare and high-fidelity indicator of evasion tradecraft.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "network-connection-pivot",
      "type": "query",
      "label": "Network connection prevalence",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "network",
        "content": "SELECT dst_endpoint_hostname, COUNT(DISTINCT device_hostname) as host_count, COUNT(*) as connection_count, MIN(time) as first_seen FROM hb_network_connection WHERE (instr(',' || '{{campaign_domains}}' || ',', ',' || LOWER(dst_endpoint_hostname) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_hostname HAVING host_count <= 5 ORDER BY host_count ASC, connection_count DESC",
        "surface": "hb_network_connection",
        "description": "Evaluate whether connections to the campaign domains are persistent and rare across the fleet.",
        "expected_signal": "A low host count for a high-volume connection pattern confirms the domains are rare targets rather than legitimate shared infrastructure."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Network connection prevalence",
        "reads": [
          "dst_endpoint_hostname",
          "device_hostname",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT dst_endpoint_hostname, COUNT(DISTINCT device_hostname) as host_count, COUNT(*) as connection_count, MIN(time) as first_seen FROM hb_network_connection WHERE (instr(',' || '{{campaign_domains}}' || ',', ',' || LOWER(dst_endpoint_hostname) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_hostname HAVING host_count <= 5 ORDER BY host_count ASC, connection_count DESC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "A low host count for a high-volume connection pattern confirms the domains are rare targets rather than legitimate shared infrastructure.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "dst_endpoint_hostname"
          ],
          "rare_below": 5
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "final-triage",
      "type": "analytic",
      "label": "Final triage",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network",
          "web"
        ],
        "context": [
          "evaluate-lead",
          "http-smuggling-check",
          "network-connection-pivot"
        ],
        "objective": "Determine if any host successfully established communication with the campaign infrastructure using ASCII smuggling techniques.",
        "description": "Correlate the DNS lead with the HTTP-layer markers and network prevalence to reach a high-confidence verdict.",
        "max_iterations": 4,
        "expected_signal": "A detailed verdict citing evidence across multiple surfaces for each affected host.",
        "success_criteria": "A per-host verdict of malicious, suspicious, or benign."
      },
      "parents": [
        {
          "id": "http-smuggling-check",
          "kind": "merge"
        },
        {
          "id": "network-connection-pivot",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-remediation",
      "type": "checkpoint",
      "label": "Route on final verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the final-triage verdict is malicious for at least one host",
        "condition": "the final-triage verdict is malicious for at least one host",
        "blind_spot": "no-http-proxy",
        "confidence": "high",
        "description": "Isolate hosts with confirmed phishing interaction and route others for review.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "final-triage"
        }
      ]
    },
    {
      "id": "contain-host",
      "type": "action",
      "label": "Isolate host",
      "config": {
        "target": "endpoint",
        "description": "Prevent further lateral movement or data exfiltration from a compromised endpoint.",
        "instructions": "Isolate the host and terminate any active network sessions to the campaign domains.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-remediation",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst review",
      "config": {
        "assignee": "analyst",
        "description": "Review the smuggling evidence and confirm if the user was successfully phished.",
        "instructions": "Review the HTTP referrer and full URL columns for the smuggling prefix. Confirm if the interaction resulted in a login attempt or file download. Check for related emails in the user's inbox to identify new lure keywords."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "default"
        },
        {
          "id": "gate-on-lead",
          "branch": "on_unavailable"
        },
        {
          "id": "route-remediation",
          "branch": "default"
        },
        {
          "id": "route-remediation",
          "branch": "on_unavailable"
        },
        {
          "id": "contain-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Record results and update the campaign indicators.",
        "instructions": "Document the hosts examined. If new campaign domains were found, add them to the campaign_domains parameter for future runs."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "on_refutes"
        },
        {
          "id": "route-remediation",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-review"
        }
      ]
    }
  ]
}