Threat actors have been observed employing an advanced phishing technique known as ASCII smuggling, which leverages invisible Unicode characters to bypass email security filters. This method, previously noted in AI prompt injection attacks, involves embedding Unicode characters from the Tags block (U+E0000 to U+E007F) to obscure malicious instructions or keywords.
Microsoft threat researchers identified a large-scale phishing campaign utilizing this technique, which reached a peak volume of approximately 2.37 million messages daily in late February 2026. While the daily message count gradually decreased through May, the campaign remains active. Microsoft's telemetry indicates that the high-volume phase of this specific technique persisted for roughly three months, beginning around February 9 and sharply declining after May 15, 2026. However, the broader campaign itself predates and continues beyond these dates.
In this particular campaign, attackers inserted invisible Unicode characters within finance-related lure words. For example, a word like "funding" might appear as "fun[invisible character]ding," thereby splitting the word and evading email filters that rely on keyword lists for detection.
Microsoft confirmed that millions of finance-themed phishing messages used this method, which proved effective in obfuscation. Despite this, Microsoft Defender for Office 365 successfully intercepted over 99% of these messages by analyzing other indicators, such as sender reputation, IP addresses, and domain characteristics.
On February 9, Microsoft identified a cluster of 148 sender domains, all finance-themed, that were responsible for approximately 96% of the messages flagged by their new hunting logic for Unicode-tag signatures. These domains frequently incorporated words like "funding," "capital," "loan," "advance," and "credit," promoting business funding, loans, and credit services.
The phishing messages were distributed through infrastructure associated with ActiveCampaign, a legitimate email-marketing platform. Following Microsoft's report of service abuse, ActiveCampaign stated that its moderation systems are designed to detect invisible Unicode characters in the same manner as visible text and flag heavy usage as suspicious.
Microsoft advises defenders to normalize or strip Unicode tag characters and other invisible code points before applying keyword, regex, or signature-based detection mechanisms. Furthermore, treating unexpected tag-block characters as a strong anomaly is recommended. Applying similar normalization processes before feeding email content to AI assistants is also suggested to mitigate the risk of prompt-injection attacks.
