Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters

Attackers exploited invisible Unicode tag characters (ASCII smuggling) to split financial keywords, causing traditional email security filters to fail to detect phishing content that humans can still read normally. This campaign targeted millions of recipients — including SBA loan applicants — using AI-generated lure content delivered through a legitimate email marketing platform (ActiveCampaign), making the emails appear credible and bypassing reputation-based defenses. The abuse of a trusted third-party sending infrastructure highlights how attackers weaponize legitimate services to evade detection. This matters because it demonstrates that signature-based and keyword-matching email filters alone are insufficient against evasive encoding techniques, leaving organizations dangerously exposed.