Phishing Campaign Uses Invisible Unicode Characters to Evade Detection

Microsoft's security experts have identified a large-scale phishing campaign that uses a technique called 'ASCII smuggling' to evade detection. The attackers insert invisible Unicode characters into email text, confusing automated security and content filtering systems.

The core of the attack lies in modifying words that typically trigger anti-spam systems. For example, the word 'financing' is altered by inserting an invisible character, making it appear as 'financ[symbol]ing'. This allows malicious emails to reach user inboxes unimpeded.

The campaign was most active in February 2026, with a peak of 2.37 million messages per day. The attackers used resources from the legitimate ActiveCampaign platform and focused on keywords such as 'capital', 'loan', 'advance', and 'credit'. Microsoft Defender was able to block over 99% of these messages by relying on complex signals rather than text analysis.

To prevent such attacks, Microsoft recommends normalizing or removing invisible Unicode characters from incoming text before performing signature analysis. They also suggest paying special attention to tag blocks (U+E0000, U+E007F) and cleaning text data before transmission to artificial intelligence systems.