Attackers Hide Phishing Lures With Invisible Unicode Characters

Threat actors are using invisible Unicode characters to hide phishing lures from email security filters.

The technique, known as ASCII smuggling, inserts hidden characters inside suspicious words. As a result, a message can appear normal to a recipient while bypassing keyword-based detection systems.

Microsoft researchers identified a major campaign that used Unicode phishing lures in millions of finance-themed emails. The activity peaked at up to 2.37 million messages per day in late February and remains active despite a decline in volume.

Invisible characters split suspicious words

ASCII smuggling uses Unicode characters from the Tags block, which covers code points from U+E0000 to U+E007F. These characters are invisible to users but still exist within the message content.

Attackers use them to split words commonly associated with phishing. For example, a word such as “funding” may contain a hidden character between two letters.

To the recipient, the word appears unchanged. However, an email filter that searches for known suspicious terms may fail to recognise it.

Researchers previously observed ASCII smuggling in AI prompt injection attacks. Threat actors now use the method to make phishing messages harder to detect.

Campaign targeted finance-related terms

Microsoft found that the campaign used finance-themed sender domains and lures. The emails promoted business funding, credit services, loans, capital and cash advances.

On February 9, Microsoft identified 148 sender domains linked to the campaign. That cluster accounted for about 96% of the messages flagged by the company’s Unicode-tag hunting logic.

The high-volume phase continued for around three months after February 9. Message volumes dropped sharply after May 15, although the wider phishing operation started earlier and continued after the attackers reduced their use of hidden Unicode characters.

Email security tools still caught most messages

The Unicode phishing lures successfully bypassed some word-list-based security checks. However, Microsoft Defender for Office 365 still detected more than 99% of the messages through other signals.

Those signals included sender details, IP addresses, domain reputation and infrastructure analysis. This shows why organisations should not rely on keyword matching alone to block phishing emails.

The attackers delivered messages through infrastructure associated with the legitimate email marketing platform ActiveCampaign. After Microsoft reported the abuse, ActiveCampaign said its moderation systems can detect invisible Unicode characters and flag excessive use as suspicious.

Defenders should normalise email content

Microsoft recommends stripping or normalising Unicode tag characters and other invisible code points before applying keyword, regular-expression or signature-based detection.

Unexpected Tags block characters should also be treated as a strong anomaly in email content. This step can prevent attackers from disguising malicious words with invisible characters.

The same process should be applied before email content reaches AI assistants. Normalising hidden Unicode characters can reduce the risk of prompt injection attacks that conceal malicious instructions from both users and automated systems.