Attackers Use Invisible Unicode Characters to Bypass Email Security Filters

Cybercriminals are using an ASCII smuggling technique in phishing campaigns to hide malicious keywords with invisible Unicode characters and evade email security filters.

ASCII smuggling was previously observed in AI prompt injection attacks, where threat actors concealed malicious instructions from users by encoding text with Unicode characters in tag blocks ranging from U+E0000 to U+E007F.

Microsoft threat researchers have now identified a large-scale phishing campaign that uses the same technique to bypass keyword-based email detection. The campaign reached as many as 2.37 million messages per day in late February. Although activity has declined since May, the operation is still active.

“The mass production phase lasted for about three months after February 9, and sharply decreased after May 15, 2026,” Microsoft explains.

“These dates indicate the use of a specific technology observed in telemetry, rather than a broader campaign that was started early and continued without that technology.”

How Unicode characters hide phishing keywords

In this campaign, attackers inserted invisible Unicode characters into words commonly associated with financial services. The hidden characters split up important terms, making them harder for traditional email security filters to recognize.

For example, the keyword “funding” can be altered to appear as fun[invisible character]ding. Although the message may look normal to the recipient, keyword-based filters may fail to identify the modified word as suspicious.

Microsoft said the technique was used in millions of financial-themed phishing messages and successfully bypassed some keyword-based detections. However, Microsoft Defender blocked more than 99% of the messages using other signals, including sender information, IP addresses, domain reputation, and related reputation checks.

Financial phishing campaign used hundreds of domains

On February 9, Microsoft identified a cluster of 148 financial-themed sender domains associated with the campaign. These domains accounted for approximately 96% of the messages flagged for Unicode tag signatures by new Defender for Office 365 hunting logic.

The domains used terms such as “funding,” “capital,” “loan,” “advance,” and “credit.” The phishing messages promoted business financing, loans, and credit services in an effort to attract potential victims.

The campaign’s messages were delivered through infrastructure connected to the legitimate ActiveCampaign email marketing platform.

ActiveCampaign, which received reports about abuse involving its services, said its moderation system detects invisible Unicode characters in the same way it detects unobfuscated text. The company also treats frequent use of these characters as suspicious activity.

Microsoft recommends Unicode normalization

Microsoft recommends that security teams remove or normalize Unicode tag characters and other invisible code points before applying keyword, regular expression, or signature-based detection. Unexpected tag block characters should also be treated as strong indicators of potentially malicious content.

Organizations should apply the same normalization process before sending email content to AI assistants. Normalizing hidden characters can reduce the risk of ASCII smuggling being used to conceal prompt injection instructions.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report