🔍 Scenario
Microsoft has raised the alarm about a high-volume phishing campaign that relies on a trick as simple as it is effective: hiding invisible Unicode characters inside keywords so that antispam filters can’t recognize them. What stands out about this case is that this technique, lately closely associated with prompt injection attacks against AI models, is being reused here for a much more traditional purpose: slipping financial phishing emails past text-matching-based detection systems.
According to the Microsoft Security Research team, the attackers aren’t using these hidden characters to inject instructions into a language model, but rather to split “sensitive” terms —like funding— in a way that a human still reads them normally, while a filtering engine searching for the literal string can no longer find it. The activity was first detected in early February 2026.
🧩 What is “ASCII smuggling”?
This technique, known as ASCII Smuggling, consists of inserting Unicode characters that don’t render visually within seemingly innocent text. The result is that the interface the user sees —email client, browser, etc.— doesn’t display those characters, so the message appears perfectly normal. However, both automated filtering systems and language models do process that complete byte string, which can lead to detection false negatives or, in the case of AI, to prompt injection scenarios, since an LLM doesn’t always clearly distinguish between a legitimate user instruction and content embedded in a third-party document, web page, or email.
The most commonly used character range in this campaign is the Unicode Tags block, which spans from U+E0000 to U+E007F. Microsoft explains that this block practically contains a silent replica of the printable ASCII alphabet: for example, U+E0041 corresponds to the letter “A” and U+E0061 to “a”. It was originally intended to tag language variants within text, a function that is now virtually obsolete, and that is precisely what makes it attractive to attackers.
📈 Scale and pattern of the campaign
According to Microsoft’s data, this wave of phishing based on invisible characters went through a high-volume phase lasting approximately three months, before dropping off sharply after May 15, 2026. A curious detail is its weekly cyclical behavior: activity dropped drastically on weekends and spiked again every Monday, as if the operators were following a conventional work schedule.
On weekdays, an estimated 1 to 2.37 million messages were sent, with a peak recorded on February 26, 2026. Microsoft links this campaign to a broader operation that abused the ActiveCampaign marketing automation platform to distribute thousands of AI-generated phishing emails, specifically targeting applicants for U.S. Small Business Administration (SBA) loans.
🎣 The origin: fake loans and financial data
This facet of the attack had already been documented in September 2025 by the Fortra Intelligence and Research Experts (FIRE) team, which described an operation focused on collecting detailed financial and business information from victims, presumably to prepare more precise spear-phishing attacks in the future.
Fortra noted at the time that the sophistication of the campaign lay in its ability to mass-generate convincing, personalized phishing web pages, adapted to different illegitimate or spoofed domains. Thanks to ActiveCampaign’s AI-based automation features, the attackers could vary the design, content, and flow of each send, achieving more believable campaigns at greater speed.
🔤 How the keyword is split
The novelty of the current campaign, according to Microsoft, is that these invisible characters from the Tags block are inserted inside financial-type keywords to break their continuity as a text string. So a term like “funding” becomes something equivalent to “fun” + invisible character U+E0020 + “ding”.
For the email recipient —and also for any processing pipeline that normalizes or discards those characters— the word still reads perfectly as “funding”. But for a detector looking for an exact match of that string, or a regular expression that doesn’t account for interspersed invisible code points, the byte sequence no longer contains the keyword contiguously, and the email passes the filter without raising suspicion.
The use of invisible or visually similar characters is not new in the world of phishing and homoglyph attacks. What’s distinctive here is the specific choice of the Unicode Tags block and, above all, the scale: several million messages per day.
🌐 Infrastructure: disposable domains and ActiveCampaign as a relay
The campaign relies on hundreds of disposable sender domains with a financial theme, using hooks that mimic business loans, credit lines, and funding advances, patterns typically associated with fraud or credential theft. The ten sender domains with the most identified hits are:
- guardiangrowthfunding[.]com
- digitalcapitalboost[.]com
- thebusinessloanexpress[.]com
- yourlocfunding[.]com
- advancefundingboost[.]com
- guardiancapitalway[.]com
- harboradvancefunding[.]com
- unitedfundingwave[.]com
- directcapitalboost[.]com
- onlinedirectfinance[.]com
In addition, these emails are sent through ActiveCampaign, which means that all links in the message body are redirected through its own click-tracking domains: acemlnd[.]com and activehosted[.]com.
🚫 What’s failing in detection?
ActiveCampaign, for its part, claims to have tested its content moderation systems against messages with invisible Unicode characters, and states that they receive the same moderation verdict as their non-obfuscated versions. It also notes that heavy use of this technique is treated as a “suspicious signal” within its system.
The problem, as Microsoft summarizes it, is that since this is a shared sending service, abuse of legitimate customers’ accounts or workflows can complicate reputation-based filtering. Since it originates from a recognized marketing platform, with established IP reputation and authentication mechanisms already in place, this malicious traffic can blend in among legitimate marketing traffic, making it harder for systems that rely on sender reputation to identify it.
✅ Best practices
To reduce risk against this type of campaign, the following should be kept in mind:
1. Antiphishing and antispam filters should normalize and strip characters from the Unicode Tags block (U+E0000–U+E007F) before applying keyword-matching rules or signatures.
2. It’s not enough to rely on the reputation of the domain or the sending provider (such as ActiveCampaign); the actual content of the message should also be inspected after normalizing invisible characters.
3. Train users to be wary of emails with urgent funding language, business loans, or credit lines, especially if they come from recently registered or little-known domains.
4. Review and block, where possible, click-tracking domains associated with known abuse campaigns, without harming legitimate traffic on the same platform.
🔐 Conclusion
This case shows that evasion techniques originally designed to manipulate AI models —such as ASCII smuggling with invisible Unicode characters— can be transferred with barely any modification to traditional spam and phishing campaigns. Effective defense requires updating detection pipelines to properly normalize text before applying any matching rule, and not relying exclusively on third-party reputation signals as the sole trust criterion.
Original source: https://thehackernews.com/2026/09/phishing-campaign-sends-millions-of.html