Attackers conceal phishing lures using invisible Unicode characters

Threat actors exploited ASCII smuggling — embedding invisible Unicode characters into finance-related keywords — to evade signature and keyword-based email security filters at scale, reaching over 2.37 million messages per day. The root issue lies in email security configurations that apply keyword detection against raw, un-normalized text, leaving a trivial but effective evasion gap. While Microsoft Defender mitigated over 99% of messages through supplementary signals, organizations relying solely on keyword-based filters would have been significantly exposed. This attack highlights how even well-established defensive controls can be undermined by subtle encoding tricks, and underscores the need for layered, technically robust detection pipelines. End users who receive such emails remain at risk of credential theft or financial fraud if they are not trained to recognize phishing cues beyond obvious keyword triggers.