unicode news
2 stories
Attackers conceal phishing lures using invisible Unicode characters
Threat actors have been observed employing an advanced phishing technique known as ASCII smuggling, which leverages invisible Unicode characters to bypass email security filters. This method, previously noted in AI prompt injection attacks, involves embedding Unicode characters from the Tags block (U+E0000 to U+E007F) to obscure malicious instructions or keywords.
Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters
A large-scale phishing campaign has been identified that leverages invisible Unicode tag characters to bypass email security filters. The campaign, which has been active for several months and involved millions of emails, was reported by Microsoft. The primary goal of the attackers appears to be the distribution of phishing lures, often disguised as business loan or funding opportunities.