Invisible Unicode Characters Power Massive Finance Phishing Campaign
Threat actors are using a technique called ASCII smuggling to hide phishing lures from email security filters, according to Microsoft threat researchers. The attackers insert invisible Unicode characters from the Tags block (U+E0000–U+E007F) inside finance-related keywords, splitting words like "funding" into "fun[invisible character]ding." This evades filters that rely on word lists to flag suspicious messages. The same technique has previously appeared in AI prompt injection attacks to hide malicious instructions from users.
The campaign peaks at up to 2.37 million daily messages in late February, with the high-volume phase lasting roughly three months before dropping sharply after May 15. Microsoft identifies a cluster of 148 finance-themed sender domains responsible for about 96% of the flagged messages, using words such as funding, capital, loan, advance, and credit. The messages promote business funding, loans, and credit services and are delivered through infrastructure tied to the legitimate ActiveCampaign email-marketing platform.
While the obfuscation method works as intended, Microsoft reports that Defender still catches over 99% of the messages using other signals such as sender reputation, IP, and domain checks. After receiving Microsoft's abuse report, ActiveCampaign says its moderation systems detect invisible Unicode characters the same way they detect plain text and treat heavy use as suspicious. Microsoft recommends that defenders strip or normalize Unicode tag characters and other invisible code points before applying content-based detections.