SHARE

Barracuda Threat Analysis: Sophisticated Phishing on the Rise

Attackers using the Tycoon kit hide malicious links with invisible spaces, odd symbols, and fake CAPTCHAs, Barracuda reports.

Written By

Luis Millares

Sep 4, 2025

Channel Insider content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More

Attackers using the Tycoon phishing-as-a-service kit have been discovered employing new techniques to hide malicious links in phishing emails, according to Barracuda’s latest 2025 Threat Spotlight.

Hiding malicious links using obscure characters, invisible spaces

Barracuda’s threat analysts have observed attackers using the Tycoon phishing kit with new URL-encoding tricks, such as inserting invisible spaces into web addresses or adding unusual characters to links, to disguise malicious URLs and evade detection by traditional security tools.

In particular, the analysts found that bad actors were using the code ‘%20’ to conceal the malicious portions of an infected link from security scans. Attackers have also inserted a “Unicode” character that resembles a dot but isn’t one, to achieve the same effect.

In addition, Barracuda’s analysts also found attackers utilizing the Redundant Protocol Prefix technique, crafting URLs that are only partially hyperlinked or contain invalid elements, such as two “https” entries or a missing “//”. This approach masks the link’s true destination while making the visible, hyperlinked portion appear safe.

The use of obscure characters, symbols, and invisible spaces is intended to make the infected URL appear less suspicious, making it more difficult for victims and traditional security controls to spot.

According to the report, the attack vector even employs a fake CAPTCHA page to mimic legitimacy and circumvent those same security systems.

Phishing emails typically contain malicious links or URLs that redirect victims to fake websites, either prompting them to download malware or tricking them into giving away sensitive data such as their account details or passwords.

As defenses improve, attackers evolve their techniques

The report highlighted the parallel advancements between attackers and defenders, emphasizing the need for a “multilayered approach” to counter increasingly sophisticated attack methods.

“The best defense is a multilayered approach with various levels of security that can spot, inspect, and block unusual or unexpected activity. Solutions that include AI and machine-learning capabilities, both at the email gateway level and post-delivery, will ensure companies are well protected,” said Megharaj Balaraddi, associate threat analyst at Barracuda Networks and author of the threat spotlight.

“As with all email-borne threats, security measures should be complemented by active and regular security awareness training for employees on the latest threats and how to spot and report them,” he added.

Security provider Barracuda has committed to strengthening its support for partners as trusted security advisors in the era of AI. Read more about how the company is driving innovation and embracing growth within the channel.

Luis Millares

Luis Millares has extensive experience reviewing virtual private networks (VPNs), password managers, and other security software. He has tested and reviewed numerous forms of tech, covering consumer technology like smartphones and laptops, all the way to enterprise software and cybersecurity products. He has authored over 450 online articles on technology and has worked for the leading tech journalism site in the Philippines, YugaTech.com. He currently contributes to the Daily Tech Insider newsletter, providing well-researched insights and coverage of the latest in technology.

Barracuda Threat Analysis: Sophisticated Phishing on the Rise

Hiding malicious links using obscure characters, invisible spaces

As defenses improve, attackers evolve their techniques

Luis Millares

Recommended for you...

Company

Categories