Phishing Campaign Exploits Text Vulnerability to Bypass Filters

Microsoft's Defender for Office 365 flagged a phishing campaign that exploited a vulnerability in how machines read text. The attackers slipped invisible Unicode tag characters into email bodies, which don't render on screen but change the underlying string processed by software.

The technique, known as 'ASCII Smuggling,' uses Unicode tag characters in the U+E0000 to U+E007F range. This allows attackers to bypass spam filters and ML-based classifiers by splitting keywords.

In a phishing campaign tracked by Microsoft, attackers used this technique to place hidden tags inside high-signal words associated with financial phishing, such as 'funding' and 'credit.' The campaign started with 21,000 messages, but within two days, the count passed 2.3 million.