On May 26, 2026, Foyl MailGuard quarantined a fraudulent invoice email (THREAT-003) targeting l.park (Procurement Department) at Ficsit Inc. Pioneer Division. The email appeared to originate from Acme Industrial Supplies, a legitimate active supplier of Ficsit, but was sent from a homoglyph domain: acme-industr1al.com — using the numeral "1" in place of the letter "l" in "industrial." The domain had been registered just 2 days prior to the attack and failed all email authentication checks (SPF, DKIM, and DMARC).

The email presented a fraudulent invoice (INV-2026-0847) for $23,847 covering a plausible industrial supply order ("Pioneer Division Equipment Maintenance Q2"). The invoice included altered banking details — routing the payment to the attacker's account rather than the legitimate Acme Industrial bank account on file. The email body directed l.park to process payment within 5 days using the attached invoice PDF.

The email was quarantined automatically by MailGuard on a combination of signals: homoglyph domain detection, fresh domain registration (2 days old), SPF/DKIM/DMARC triple failure, and payment detail change instruction. No financial loss occurred. l.park was unaware of the email. Vendor verification with Acme Industrial confirmed they did not send this invoice and are aware their brand is being spoofed.

A homoglyph attack (also called a lookalike domain or typosquat) exploits visual similarity between characters to register a domain that appears identical to a legitimate domain when read quickly. In this case, the numeral "1" (one) was substituted for the letter "l" (lowercase L) in "industrial" — a substitution that is virtually invisible in many fonts at normal reading sizes.

The attacker chose this specific homoglyph technique because: (1) the substituted character is commonly confused in sans-serif fonts popular in email clients, (2) the domain was plausible enough to pass a quick human review, and (3) registering a homoglyph of an existing domain is easy and cheap. The domain had no website content, confirming it was registered solely for email-based fraud.

All three email authentication mechanisms failed for THREAT-003:

The fraudulent invoice (INV-2026-0847, PDF attachment) was crafted to mimic Acme Industrial Supplies' invoice format, including their logo and standard invoice layout. Key fraud indicators present in the invoice:

MailGuard flagged THREAT-003 via a combination of rules:

VF-001 was a vendor impersonation invoice fraud blocked before any financial impact. The attack succeeded in reaching MailGuard — it was stopped by automated detection, not by process controls. If MailGuard had not detected it, the email may have reached l.park's inbox and been processed as a legitimate invoice, particularly given the plausible format and timing (Q2 maintenance invoices are expected in this period).

The following comparison illustrates how the homoglyph substitution is nearly invisible in common email client fonts. Security awareness training should include this type of comparison.

Legitimate vendor domain:
  acme-industrial.com
  Position 14: l  ← lowercase letter "L"

Fraudulent domain (this incident):
  acme-industr1al.com
  Position 14: 1  ← numeral "one"

In common sans-serif fonts (Arial, Helvetica, Calibri, etc.):
  "l" and "1" appear nearly identical.

Visual appearance in most email clients:
  acme-industrial.com   ← legitimate
  acme-industr1al.com   ← FRAUDULENT (visually indistinguishable without zoom)

Additional homoglyphs that should be monitored (not yet observed):
  acme-industria1.com   (numeral 1 for final l)
  acme-industrla1.com   (transposition + numeral)
  acme-1ndustrial.com   (numeral 1 for capital I)