The USPS Link That Looked Right Until It Wasn't

A high-risk phishing campaign impersonating USPS used zero-width Unicode characters to make links display as legitimate usps.com URLs while the actual href pointed to an attacker-controlled domain proxied through Google Translate; the emails transited Microsoft 365 Groups to preserve ARC/SPF signals and bury a DMARC failure. The report provides IOCs (malicious translate.goog URL, domains, sender, nameservers), explains why standard URL and authentication checks failed, and recommends dereferencing redirects, inspecting href values, and adjusting training and gateway detection.