Attackers have used invisible Unicode characters to disguise finance-themed phishing emails, allowing a campaign to bypass keyword-based security filters and deliver up to 2.37 million messages a day, Microsoft has said.
The technique, known as ASCII smuggling, breaks up words in the body of an email by inserting characters that cannot be seen by the recipient. A term such as “funding” can therefore appear to a security system as “funding”, while remaining visually unchanged to the reader.
Microsoft’s threat researchers identified the campaign after examining a large volume of messages containing characters from Unicode’s Tags block. The operation remained active after its busiest period, although use of the technique declined from May.
Microsoft said the high-volume phase lasted for about three months after 9 February and fell sharply after 15 May. The dates relate specifically to the use of invisible Unicode characters observed in its telemetry, rather than the wider phishing campaign, which began earlier and continued using other methods.
Invisible characters concealed finance-related lures
The emails promoted business funding, loans and credit services. Domains and sender addresses used terms including “funding”, “capital”, “loan”, “advance” and “credit” to support the financial theme.
On 9 February, Microsoft identified a group of 148 sender domains associated with the activity. The company said they accounted for about 96% of the messages detected by new Defender for Office 365 rules designed to identify the Unicode signatures.
The messages were sent through infrastructure linked to the legitimate email-marketing provider ActiveCampaign. After Microsoft reported suspected abuse of its service, ActiveCampaign said its moderation systems detect invisible Unicode characters in the same way as unobfuscated text and regard extensive use of them as suspicious.
Microsoft said the evasion method had been used in millions of phishing messages and was effective against detections relying on word lists. However, Defender still blocked more than 99% of the emails using other indicators, including the sender, internet protocol address, domain and reputation checks.
The company has advised security teams to remove or standardise Unicode tag characters and other invisible code points before applying keyword, regular-expression or signature-based checks. Unexpected characters from the Tags block should be treated as a significant warning sign, it said.
The same preparation should be applied when email content is passed to AI assistants, Microsoft said, helping to reduce the risk that hidden text could be used to conceal malicious instructions.
