Full Report
Microsoft is alerting of a "high-volume phishing campaign" that's using invisible Unicode tag characters to bypass email filters. "Instead of using these characters to hide instructions from people while exposing them to AI models, the attacker used them to split financial lure words such as 'funding' to prevent email filters from parsing them," the Microsoft Security Research team said. The
Analysis Summary
# Tool/Technique: ASCII Smuggling (via Unicode Tags)
## Overview
ASCII Smuggling is an evasion technique that utilizes invisible or non-rendering Unicode characters to conceal instructions or disrupt text parsing. In this specific campaign, attackers use characters from the **Unicode Tags block (U+E0000 to U+E007F)** to split keywords in phishing lures. While the text appears normal to a human recipient, the insertion of these characters prevents security filters from recognizing prohibited words or signatures, as the literal byte sequence is altered.
## Technical Details
- **Type:** Evasion Technique / Obfuscation
- **Platform:** Email Clients, Web Browsers, and AI/LLM interfaces
- **Capabilities:** Bypassing keyword-based email filters, prompt injection, and signature evasion.
- **First Seen:** Early February 2026 (High-volume phase peaked late Feb 2026; technique concepts noted as early as late 2025).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.001 - Phishing: Spearphishing Attachment/Link]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information]
- [T1027.003 - Steganography] (Conceptual overlap with "smuggling" data in plain sight)
- **[TA0043 - Reconnaissance]**
- [T1598 - Phishing for Information]
## Functionality
### Core Capabilities
- **Keyword Splitting:** Inserts Unicode tag characters into financial lure words (e.g., `fun<U+E0020>ding`) to break contiguous string matching in security gateways.
- **Visual Deception:** Leverages the fact that most human user interfaces (UIs) do not render the U+E0000 block, ensuring the recipient sees a perfectly legible and professional email.
- **Signature Evasion:** Circumvents Regex (Regular Expressions) and static filters that do not account for interleaved invisible code points.
### Advanced Features
- **AI Model Manipulation:** Exploits the inability of Large Language Models (LLMs) to distinguish between genuine instructions and "smuggled" text, potentially allowing for prompt injection within the phishing workflow.
- **Automation Integration:** Utilizes marketing automation platforms (ActiveCampaign) to vary design, content, and flow dynamically, making mass-produced emails feel personalized.
## Indicators of Compromise
- **File Hashes:** None provided in the report (primarily link/text-based).
- **File Names:** N/A.
- **Registry Keys:** N/A.
- **Network Indicators:**
- Hundreds of disposable, finance-themed sender domains (specific domains not listed, but characterized by lures mimicking SBA loans and business lines of credit).
- Use of `activecampaign[.]com` infrastructure for distribution.
- **Behavioral Indicators:**
- High-volume email spikes on weekdays (1M to 2.37M messages/day).
- Radio silence on weekends (Saturday/Sunday).
## Associated Threat Actors
- Unknown (Assessment ties the activity to a broader campaign first identified by Fortra in September 2025 targeting SBA loan applicants).
## Detection Methods
- **Signature-based detection:** Update filters to flag or strip characters in the deprecated Unicode Tags block (`U+E0000` to `U+E007F`) within email bodies and headers.
- **Behavioral detection:** Identify anomalies in email volume that follow a strict weekday-only cadence.
- **Normalization:** Implement parsing pipelines that normalize Unicode text (e.g., NFKC normalization) or drop non-printable control characters before passing content to security scanners.
## Mitigation Strategies
- **Prevention measures:** Configure email gateways to block or quarantine messages containing deprecated or non-rendering Unicode blocks commonly used for tagging.
- **Hardening recommendations:** Disable the rendering of Unicode Tags in internal applications and educate employees on the possibility of "invisible" characters in suspicious financial lures.
- **Vendor Configuration:** Review settings in marketing automation tools (like ActiveCampaign) to prevent the distribution of AI-generated content that bypasses internal safety checks.
## Related Tools/Techniques
- **Homoglyph Attacks:** Using look-alike characters (e.g., Cyrillic 'а' instead of Latin 'a').
- **Prompt Injection:** Using hidden text to hijack LLM behavior.
- **Zero-Width Space (ZWSP) Obfuscation:** Using U+200B to split words (a predecessor to the Unicode Tag method).