Attackers conceal phishing lures using invisible Unicode characters

Summary

Threat actors are employing an ASCII smuggling technique, inserting invisible Unicode characters into finance-related keywords to evade email security filters. Microsoft observed a large-scale phishing campaign utilizing this method, which peaked at over 2.37 million daily messages. While Defender blocked over 99% of these messages through other detection signals, Microsoft recommends normalizing Unicode characters before applying keyword-based detections to mitigate such threats.

Full text

Attackers conceal phishing lures using invisible Unicode characters By Bill Toulas September 6, 2026 10:23 AM 0 Threat actors have adopted the ASCII smuggling technique in phishing campaigns, using invisible Unicode characters to evade email security filters. ASCII smuggling has been used in AI prompt injection attacks to conceal malicious instructions from users by encoding them with Unicode characters from the Tags block (U+E0000–U+E007F). Microsoft threat researchers discovered a large-scale phishing campaign using this technique, which peaked at up to 2.37 million daily messages in late February. Although the volume has dropped gradually in May, the operation is still active. “The high-volume phase persisted for roughly three months after February 9 and dropped sharply after May 15, 2026,” explains Microsoft. “These dates bound the observed use of the specific technique in our telemetry, not the broader campaign, which started earlier without it and continued without it.” Phishing email delivery volumesSource: Microsoft In this campaign, the attacker inserts an invisible Unicode character inside finance-related lure words to split them. In doing so, a keyword like ‘funding’ becomes something like ‘fun[invisible character]ding’ and evades email filters that rely on word lists to detect suspicious or malicious messages. Sample of a phishing messageSource: Microsoft Microsoft says the method has been used in millions of finance-themed phishing messages and works as intended, although Defender still caught over 99% of the messages based on other signals (sender, IP, domain, reputation checks). On February 9, Microsoft identified a cluster of 148 finance-themed sender domains powering this campaign, accounting for about 96% of all messages its new Defender for Office 365 hunting logic flagged for Unicode-tag signatures. Unicode characters in the emailSource: Microsoft The domains used words such as “funding,” “capital,” “loan,” “advance,” and “credit,” and the messages promoted business funding, loans, and credit services. The messages were delivered through infrastructure associated with the legitimate ActiveCampaign email-marketing platform. After receiving Microsoft’s report of service abuse, ActiveCampaign said its moderation systems detect invisible Unicode characters the same way they detect unobfuscated text and treat heavy use as suspicious. Microsoft recommends that defenders strip or normalize Unicode tag characters and other invisible code points before applying keyword, regex, or signature-based detection, and treat unexpected tag-block characters as a strong anomaly. Applying the same normalization before passing email content to AI assistants should mitigate the risk of prompt-injection attacks. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report Related Articles: Microsoft says some users can’t open the Teams desktop clientExchange Online outage causes email delays, 'Server busy' errorsExchange Online to block emails from vulnerable on-prem serversMicrosoft: KB5120998 mouse reset bug affects only non-English PCsMicrosoft says Windows 11 KB5120998 update resets mouse settings

Entities