Phishers Use Invisible Unicode Characters to Bypass Email Security

Threat actors have employed an advanced phishing technique called ASCII smuggling to evade email security filters. This tactic involves using invisible Unicode characters to conceal malicious instructions, making it difficult for defenders to detect suspicious messages.

A recent large-scale phishing campaign, which peaked at up to 2.37 million daily messages in late February, utilized this technique. The campaign's volume dropped sharply after May 15, but the operation remains active.

The attackers inserted invisible Unicode characters into finance-related lure words, effectively splitting them and evading email filters that rely on word lists to detect malicious messages. For example, a keyword like 'funding' became 'fun[invisible character]ding.'

Microsoft researchers discovered the campaign and noted that although the method has been used in millions of finance-themed phishing messages, their Defender still caught over 99% of the messages based on other signals.