{"success":true,"data":{"id":"body-invisible-char-obfuscation","label":"Body inserts zero-width chars between letters of keywords — filter evasion","description":"The email body contains a zero-width or word-joiner Unicode character (U+200B ZWSP, U+200C ZWNJ, U+200D ZWJ, U+2060 word joiner, U+FEFF BOM, etc.) sitting BETWEEN two ASCII letters — e.g. `p\\u200Bassword reset`, `w\\u200Dire transfer`, `ver\\u2060ify your account`. This is a keyword-filter evasion technique: the rendered text looks normal to the user, but a naive keyword scanner never matches `password`, `wire transfer`, or `verify`. The detection is restricted to \"invisible char between two ASCII letters\" specifically to avoid false-firing on legitimate emoji ZWJ sequences (skin-tone modifiers, family emoji), Arabic/Indic ZWJ/ZWNJ rendering hints, or stray BOMs at message start. No legitimate English/Latin word contains a zero-width character mid-word — this shape is uniquely diagnostic of evasion intent. Weighted at +3, parallel to `body-html-entity-obfuscation` and `hidden-text-in-body`: strong evasion indicator that combines with whatever body-level text signals the attacker was trying to hide.","tier":"danger","category":"body","isThin":false}}