{"success":true,"data":{"id":"invisible-chars-in-from","label":"Invisible control characters in From header — zero-width joiner / RTL override attack","description":"From header contains invisible / control Unicode characters — zero-width joiner (U+200D), zero-width space (U+200B), right-to-left override (U+202E), word joiner (U+2060), byte-order mark (U+FEFF), etc. Attackers insert these to visually mask the true domain (\"security@paypal\\u200B.evil.com\" displays as \"security@paypal.evil.com\" but the parser sees the ZWSP), to reverse displayed text with RTL overrides, or to bypass substring-match whitelists. Legitimate email addresses never contain these characters.","tier":"danger","category":"body","isThin":false}}