![\"Attackers](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2026\/09\/Phishing.jpg\")
<\/p>\n<\/p>\n
Threat actors have adopted the ASCII smuggling technique in phishing campaigns, using invisible Unicode characters to evade email security filters.<\/p>\n
ASCII smuggling has been used in AI prompt injection attacks<\/a> to conceal malicious instructions from users by encoding them with Unicode characters from the Tags block (U+E0000\u2013U+E007F).<\/p>\n Microsoft threat researchers discovered a large-scale phishing campaign using this technique, which peaked at up to 2.37 million daily messages in late February. Although the volume has dropped gradually in May, the operation is still active.<\/p>\n \u201cThe high-volume phase persisted for roughly three months after February 9 and dropped sharply after May 15, 2026,\u201d explains Microsoft<\/a>.<\/p>\n \u201cThese dates bound the observed use of the specific technique in our telemetry, not the broader campaign, which started earlier without it and continued without it.\u201d<\/p>\n \u00a0<\/p>\n In this campaign, the attacker\u00a0inserts an invisible Unicode character inside finance-related lure words to split them.<\/p>\n In doing so, a keyword\u00a0like \u2018funding\u2019 becomes something like\u00a0\u2018fun[invisible character]ding\u2019 and evades email filters that rely on word lists to detect suspicious or malicious messages.<\/p>\n Microsoft says the method has been used in millions of finance-themed phishing messages and works as intended, although Defender still caught over 99% of the messages based on other signals (sender, IP, domain, reputation checks).<\/p>\n On February 9, Microsoft identified a cluster of 148 finance-themed sender domains powering this campaign, accounting for about 96% of all messages its new Defender for Office 365 hunting logic flagged for Unicode-tag signatures.<\/p>\n The domains used words such as \u201cfunding,\u201d \u201ccapital,\u201d \u201cloan,\u201d \u201cadvance,\u201d and \u201ccredit,\u201d and the messages promoted business funding, loans, and credit services.<\/p>\n The messages were delivered through infrastructure associated with the legitimate ActiveCampaign email-marketing platform.<\/p>\n After receiving Microsoft\u2019s report of service abuse, ActiveCampaign said its moderation systems detect invisible Unicode characters the same way they detect unobfuscated text and treat heavy use as suspicious.<\/p>\n Microsoft recommends that defenders strip or normalize Unicode tag characters and other invisible code points before applying keyword, regex, or signature-based detection, and treat unexpected tag-block characters as a strong anomaly.<\/p>\n Applying the same normalization before passing email content to AI assistants should mitigate the risk of prompt-injection attacks.<\/p>\n![\"Phishing](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2026\/09\/volumes.jpg\")
Phishing email delivery volumes
Source: Microsoft<\/p>\n![\"Sample](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2026\/09\/email(2).jpg\")
Sample of a phishing message
Source: Microsoft<\/p>\n![\"Unicode](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2026\/09\/chatacters.jpg\")
Unicode characters in the email
Source: Microsoft<\/p>\n
![\"article](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2026\/09\/p-blue-report-26.jpg\")
<\/a><\/p>\n