The Squarespace Phish With No Brand Text to Match

A sophisticated credential-harvesting phishing campaign impersonated Squarespace and evaded text-based detection by embedding the wordmark in an image and inserting many invisible U+206E characters into the subject and display name; the message was sent from a hijacked 24-year-old domain (oldanopetroli.com) enrolled in Aliyun DirectMail so SPF/DKIM/DMARC passed, and the payment link redirected to a flagged malicious URL on studiointech.net — detection succeeded via link reputation and sender-behavior signals rather than content matching.