Invisible Unicode Characters Used in High-Volume Phishing Campaign to Evade Filters
A sophisticated phishing campaign is employing invisible Unicode tag characters to split financial lure words, effectively bypassing traditional email filters and detection mechanisms.
A significant phishing campaign is leveraging invisible Unicode tag characters to circumvent email filters, according to an alert from Microsoft Security Research. Threat actors are using these characters to split common financial keywords, such as 'funding,' into parts that are unrecognizable to standard detection systems. This technique, first observed in early February 2026, demonstrates how advanced evasion tactics, often associated with AI-era threats, are being adapted for more traditional phishing operations.
The method employed is a form of ASCII smuggling, where non-rendering Unicode characters are embedded within text. These characters are invisible to human readers, making the email appear normal, but they can be processed by email filters and AI models in unexpected ways. The most frequently abused characters belong to the Unicode Tags block (U+E0000 to U+E007F), which contains a shadow copy of ASCII characters originally intended for language tagging but now largely deprecated. This allows attackers to disguise malicious content while maintaining a semblance of legitimacy.
Microsoft noted that this campaign entered a high-volume phase for approximately three months, peaking around February 26, 2026, before declining significantly after mid-May. The operation exhibited a weekly pattern, with activity almost ceasing on weekends and resuming with full force on Mondays. Daily message volumes were estimated to range between 1 to 2.37 million, indicating a substantial reach and operational capacity.
This campaign is believed to be linked to a broader phishing operation that utilized the ActiveCampaign marketing platform to distribute AI-generated phishing emails targeting applicants for Small Business Administration (SBA) loans. Fortra Intelligence and Research Experts (FIRE) had previously detailed this operation in September 2025, highlighting its focus on collecting detailed business and financial information for future spear-phishing attacks. The sophistication lay in the mass production of tailored, convincing websites that impersonated legitimate domains.
The current iteration of phishing emails uses the invisible Unicode tags as an obfuscation pattern. By inserting these characters within keywords like 'funding,' the word is split into 'fun⟨U+E0020⟩ding.' To the recipient and to parsing systems that normalize or drop these characters, the word still appears as 'funding.' However, to security tools that rely on exact string matching or regular expressions that do not account for interleaved invisible code points, the contiguous keyword is broken, thus evading detection.
While the use of invisible or look-alike characters is not new to phishing, the novelty here lies in the specific choice of Unicode Tags block characters and the sheer scale of the campaign. The attackers have been observed using hundreds of disposable, finance-themed sender domains, employing lures related to business loans, lines of credit, and advance funding. These domains often mimic legitimate financial institutions to harvest credentials or conduct fraud.
Furthermore, emails originating from these finance-themed domains are routed through ActiveCampaign, meaning all outbound links pass through its click-tracking domains. This tactic leverages the reputable infrastructure of a legitimate marketing platform, making the malicious traffic appear more like legitimate marketing communications and complicating reputation-based filtering for security solutions. ActiveCampaign has stated that its systems treat heavy use of such techniques as a suspicious signal and that its content moderation systems process messages with invisible Unicode characters as their unobfuscated equivalents.