Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters

Severity

Medium

A large-scale phishing campaign has been using invisible Unicode characters to disguise financial keywords and evade email security controls. Microsoft observed the campaign sending up to 2.37 million phishing messages per weekday, with activity reaching its highest volume on February 26, 2026.

The technique, known as ASCII Smuggling, hides non-rendering Unicode characters inside otherwise normal-looking text. While the characters are invisible to recipients, email security systems may interpret the altered text differently, allowing phishing messages to bypass filters that rely on keyword or pattern matching.

How?

The attackers use characters from the Unicode Tags block (U+E0000 to U+E007F), which contains encoded versions of standard ASCII characters. These characters are inserted into financial terms commonly used in phishing emails.

For example, the word “funding” can be modified by inserting an invisible Unicode character between its letters. To the recipient, the word still appears as “funding,” but a security filter looking for the exact string may no longer recognize it because the underlying character sequence has been altered.

The technique was used at significant scale, with the campaign operating at high volume for roughly three months before activity dropped sharply after May 15, 2026. Activity followed a weekly pattern, with volumes dropping substantially during weekends before increasing again on Mondays.

The phishing emails used hundreds of disposable finance-themed domains and impersonated business loan, lines of credit, and advance-funding services. The messages were also distributed through the ActiveCampaign marketing and automation platform, causing links in the emails to pass through ActiveCampaign’s click-tracking domains, including acemlnd[.]com and activehosted[.]com.

Microsoft assessed the activity as connected to a broader phishing operation that previously abused ActiveCampaign to distribute AI-generated phishing emails targeting Small Business Administration (SBA) loan applicants. The earlier campaign was reported by Fortra in September 2025 and focused on collecting detailed business and financial information that could later support more targeted phishing activity.

The use of a legitimate marketing platform can also make the emails harder to distinguish from legitimate traffic. Since the messages originate from established infrastructure with legitimate IP reputation and authentication, reputation-based email filtering may be less effective against the campaign.

The technique demonstrates how invisible Unicode characters can be adapted from AI-focused evasion and prompt-injection techniques for traditional phishing campaigns, allowing attackers to alter how security controls interpret malicious content without changing how the message appears to the recipient.

The use of invisible Unicode characters in phishing messages, especially within financial keywords, may indicate an attempt to bypass email filtering and should be considered when analyzing suspicious emails.

Source

https://thehackernews.com/2026/09/phishing-campaign-sends-millions-of.html