Phishing Attackers Hide in Plain Sight with Invisible Unicode Characters
Cybersecurity researchers have uncovered a sophisticated phishing technique used by attackers to evade email security filters. By concealing malicious lures within invisible Unicode characters, threat actors are able to send millions of finance-themed emails that slip under the radar of even the most advanced defenses.
The technique, known as ASCII smuggling, has been around for a while but has gained traction in recent months. It involves encoding malicious instructions with Unicode characters from the Tags block (U+E0000–U+E007F), making them invisible to the naked eye. This allows attackers to create phishing emails that appear legitimate at first glance.
Microsoft’s threat researchers discovered a large-scale phishing campaign using this technique, which peaked at an astonishing 2.37 million daily messages in late February. Although the volume has dropped slightly since then, the operation is still active. The campaign targets finance-related keywords, such as “funding,” “capital,” and “loan,” by inserting invisible Unicode characters to split them. For example, a keyword like “funding” becomes something like “fun[invisible character]ding.” This clever trick allows attackers to evade email filters that rely on word lists to detect suspicious or malicious messages.
What’s particularly concerning about this campaign is its scale and sophistication. Microsoft estimates that the technique has been used in millions of finance-themed phishing emails, making it one of the most significant threats of the year so far. Despite this, the company’s Defender for Office 365 hunting logic was still able to catch over 99% of the messages based on other signals.
The domains used in the campaign promote business funding, loans, and credit services, and were delivered through infrastructure associated with the legitimate ActiveCampaign email-marketing platform. After receiving Microsoft’s report of service abuse, ActiveCampaign stated that its moderation systems detect invisible Unicode characters the same way they detect unobfuscated text and treat heavy use as suspicious.
To combat this threat, Microsoft recommends that defenders strip or normalize Unicode tag characters and other invisible code points before applying keyword, regex, or signature-based detection. Additionally, treating unexpected tag-block characters as a strong anomaly can help prevent prompt-injection attacks. By taking these precautions, organizations can reduce the risk of falling victim to phishing campaigns like this one.
Ultimately, this campaign serves as a reminder that even the most advanced defenses can be breached with enough sophistication and determination. It’s essential for businesses and individuals to stay vigilant and adapt their security measures to keep pace with evolving threats.
Source: Bleeping Computer — 2026-09-06