Invisible Unicode Is Helping Phishing Emails Slip Past Filters — and Microsoft Says the Campaign Has Reached Millions

Phishing has always depended on deception, but attackers are increasingly experimenting with techniques that were once discussed mainly in the context of artificial intelligence. Microsoft is now warning about a large-scale campaign that uses invisible Unicode characters to manipulate how email security systems interpret suspicious words, allowing malicious messages to appear perfectly normal to the people receiving them while becoming harder for some automated filters to recognise.

The campaign is notable not because invisible characters are entirely new, but because of the scale at which they are being used. Microsoft says weekday activity has reached between roughly one million and 2.37 million messages, with the campaign peaking on 26 February 2026. The technique demonstrates how ideas originally associated with AI prompt manipulation can be repurposed for much more traditional fraud, including business-loan and financial phishing.

The Email Looks Normal, but the Underlying Text Is Different

The trick relies on Unicode characters that generally do not appear visually when displayed in an email. To a recipient, a word such as "funding" may look completely ordinary. Underneath, however, invisible characters can be inserted between the visible letters so that the word is no longer stored as one continuous string.

For example, an attacker could break up a financial keyword by inserting a hidden Unicode code point between two portions of the word. The recipient still sees "funding," but a security rule looking specifically for the literal sequence of letters may see something different. If the filtering system does not remove or normalise those hidden characters before scanning the message, the keyword detection rule can potentially be bypassed.

This is a subtle attack because there is nothing obviously suspicious for the user to spot in the visible word. The email does not necessarily contain strange symbols, misspellings or unusual spacing that would make the manipulation obvious.

Microsoft Connects the Technique to ASCII Smuggling

Microsoft describes the underlying method as a form of ASCII smuggling, where invisible or non-rendering Unicode characters are used to hide additional information inside text that appears harmless. The technique has previously attracted attention because artificial intelligence models can sometimes process hidden content that the person viewing the page cannot see.

That creates an interesting mismatch between human perception and machine interpretation. A user sees one thing, while the underlying software may ingest something else entirely. In AI systems, that difference can potentially be exploited for prompt injection; in this phishing campaign, attackers are effectively using the same principle in reverse by trying to make filters fail to recognise suspicious text that still looks normal to humans.

Microsoft says the most heavily abused characters in this campaign come from the Unicode Tags block, ranging from U+E0000 to U+E007F. This portion of Unicode contains tag characters corresponding to ordinary printable ASCII characters and was originally created for language-tagging purposes, but it has largely fallen out of mainstream use.

An AI-Era Evasion Technique Is Being Used Against Traditional Email Security

What makes the campaign particularly interesting is the way attackers have adapted a technique associated with modern AI security research into a conventional phishing operation. The goal is not necessarily to manipulate an AI assistant directly. Instead, the hidden characters interfere with security systems that rely on literal keyword matching, regular expressions or parsing rules that are not prepared for invisible code points inserted into otherwise ordinary words.

This is a reminder that defensive techniques need to evolve alongside attacker behaviour. A spam filter that correctly blocks the word "funding" may still fail if it assumes that the visible text and the underlying character sequence are identical. Security systems increasingly need to normalise text before analysing it, particularly when unusual Unicode ranges appear inside common words.

The broader lesson is that AI-related security research can have consequences far beyond AI applications themselves. Attackers regularly borrow concepts from one area of security and apply them somewhere else if the technique provides an advantage.

The Campaign Reached Millions of Messages Per Day

Microsoft says the activity first appeared in early February 2026 and then entered a high-volume phase that continued for roughly three months. Message volumes reportedly fell sharply after 15 May, but before that decline the campaign was operating at enormous scale.

The sending pattern was also surprisingly regular. Activity followed a largely weekly rhythm, with volumes dropping significantly during weekends and returning strongly on Mondays. During weekdays, Microsoft estimates that the operation generated between approximately one million and 2.37 million emails, with the highest recorded level occurring on 26 February.

That scale matters because even a very low success rate can become profitable when millions of messages are sent. If only a tiny fraction of recipients click, enter information or continue engaging with the attacker, the campaign can still generate thousands of potential victims.

Financial and Business Loan Lures Were a Major Theme

The phishing operation relied heavily on finance-related themes. Emails imitated business funding offers, lines of credit, advance financing and other lending-related communications that could attract small businesses or people actively looking for capital.

These lures are particularly effective because they create a believable reason for recipients to provide detailed financial or business information. A small-business owner expecting loan-related correspondence may be more likely to open a message that appears to offer funding, especially if the language and branding look professional.

Microsoft links the latest activity to a broader operation that had previously targeted Small Business Administration loan applicants. The objective appears to extend beyond simply collecting usernames and passwords. Detailed business and financial information gathered during the first interaction could later be used to construct highly personalised spear-phishing attacks.

AI Can Make Mass Phishing Look Far More Personal

The broader campaign had previously been analysed by Fortra's Intelligence and Research Experts team, which described attackers using AI-powered marketing capabilities to generate large numbers of convincing phishing messages and websites. Instead of creating one generic phishing page and sending it to everyone, attackers can increasingly vary the language, layout and flow automatically.

That is an important shift. Historically, mass phishing was often relatively easy to identify because everyone received almost the same badly written email. AI makes it easier to create thousands of variations that feel more personalised without requiring attackers to manually write each message.

A criminal group can potentially change company names, funding amounts, layouts, wording and other details automatically. The result may still be fraudulent, but it can look much closer to legitimate business communication than traditional bulk spam.

ActiveCampaign Was Used as Part of the Delivery Infrastructure

The campaign also made use of ActiveCampaign, a legitimate marketing and automation platform. Using established marketing infrastructure can make malicious messages more difficult to distinguish from ordinary commercial email because the sending platform already has a legitimate reputation, authentication configuration and established network presence.

Emails sent through the service can also route outbound links through ActiveCampaign's normal click-tracking infrastructure. That means recipients and security systems may initially encounter domains associated with a legitimate marketing provider rather than the final destination chosen by the attacker.

This creates an additional challenge for reputation-based filtering. Blocking every message or link associated with a major marketing platform would create enormous numbers of false positives, so attackers can sometimes exploit trusted services to make malicious activity blend into legitimate traffic.

Hundreds of Disposable Finance-Themed Domains Were Used

Microsoft says the operation involved hundreds of disposable domains designed to resemble financial businesses. Names frequently included words related to capital, funding, loans and business growth, making them appear plausible at a quick glance.

Among the domains observed were names resembling organisations such as:

The names are deliberately generic but credible enough to resemble legitimate financing companies. Someone searching for business funding may not immediately know whether a company called something like "Direct Capital Boost" actually exists, which gives the attackers an opportunity to establish trust before the victim investigates further.

Reputable Email Platforms Can Complicate Reputation-Based Filtering

Using trusted marketing services does not mean those platforms knowingly support phishing. In many cases, attackers compromise accounts, create fraudulent accounts or abuse legitimate automation features before the provider detects the activity.

Microsoft notes that shared sending platforms can make filtering more complicated because malicious messages inherit some of the infrastructure reputation associated with the legitimate provider. The email may come from properly authenticated systems with established sending IP addresses, making it look more similar to an ordinary marketing campaign than a message originating from a newly created malicious mail server.

This illustrates why modern email security cannot rely entirely on sender reputation. A legitimate infrastructure provider can still be abused, so the content, destination links, behavioural patterns and surrounding context also need to be analysed.

ActiveCampaign Says Its Moderation Detects the Obfuscation

ActiveCampaign says it has tested messages containing invisible Unicode characters against its own content-moderation systems. According to the company, emails using this technique receive the same moderation outcome as their unobfuscated equivalents.

The platform also says heavy use of invisible characters is treated as a suspicious signal. That is important because normal business communications rarely have a legitimate reason to insert large quantities of Unicode tag characters into everyday words.

Even so, campaigns at this scale demonstrate how determined attackers can continually test combinations of domains, accounts, content variations and delivery infrastructure until some messages successfully pass through defensive layers.

Why Simple Keyword Filters Are No Longer Enough

This campaign exposes a weakness in security controls that depend too heavily on exact text matches. Keyword-based rules are still useful, but they become fragile when attackers can alter the underlying character sequence without changing what the recipient actually sees.

Modern filtering systems need to inspect text after Unicode normalisation and remove or flag characters that serve no legitimate purpose in ordinary email. They also need to combine textual analysis with other signals such as sender behaviour, domain age, link destinations, account history and unusual sending volume.

The same principle applies to security tools using machine learning. AI-based filters are not automatically immune to obfuscation. They still depend on how text is parsed and preprocessed before the model evaluates it.

Invisible Characters Create a Human-Machine Mismatch

The most interesting part of this attack is the gap between what the human sees and what the software processes. Security systems traditionally assume that the visible message closely represents the underlying data. Invisible Unicode challenges that assumption.

From the user's perspective, "funding" is simply "funding." From the perspective of an unprepared parser, however, the sequence could contain several additional code points that interrupt the word. That difference becomes exploitable when security rules operate on the raw text without first cleaning it.

Attackers frequently look for these kinds of mismatches. Similar ideas appear in homoglyph attacks where one alphabet's characters are substituted for visually similar characters from another alphabet, creating domain names or text that appear legitimate at a glance.

The Technique Is Not Entirely New, but the Scale Is

Invisible and look-alike characters have been used in phishing for years, so Unicode abuse itself is not a new concept. What stands out in Microsoft's findings is the specific reliance on the Unicode Tags block and the enormous number of messages generated.

This shows how inexpensive automation has made experimentation for attackers. Once an evasion method works, it can be deployed across millions of messages almost immediately. AI-assisted content generation makes scaling even easier because criminals can create countless variants without manually preparing each campaign.

The result is a phishing ecosystem where attackers can iterate much more quickly than before. A technique does not need to remain effective for years; even a few weeks of successful evasion may be enough to justify its use.

Businesses Are Attractive Targets Because the Follow-Up Can Be More Valuable

Business-financing phishing is particularly concerning because the information collected can be far more valuable than a single consumer login. Companies applying for financing may provide details about revenue, ownership, banking relationships, employees and financial needs.

Attackers can use those details to construct more convincing future scams. Someone who knows that a business recently applied for a particular loan can impersonate a lender, accountant or government agency with far greater credibility than someone sending a completely generic message.

That is why the initial phishing page may be only the first stage. The information collected could support subsequent business email compromise, payment fraud or targeted credential theft.

Users Should Be Cautious Even When the Email Looks Perfectly Normal

The invisible Unicode technique reinforces an uncomfortable truth: recipients cannot always identify phishing by spotting obvious spelling errors or strange formatting. A message can look completely normal while containing technical manipulation that is invisible on the screen.

Users should therefore pay more attention to the context of the message. Unexpected loan offers, urgent financing approvals, unfamiliar lenders and requests for financial or login information should be treated cautiously even when the email looks professionally written.

Rather than clicking directly on a link, recipients should independently verify the organisation through a known website or contact channel. For businesses, staff handling financing, accounting and payments should be particularly careful because those roles are frequently targeted with personalised phishing.

Security Teams Need to Look Beyond What Is Visually Displayed

For enterprise defenders, the campaign provides another reason to inspect the raw structure of incoming email rather than relying only on the rendered appearance. Invisible characters, unusual Unicode ranges and unexpected text-normalisation patterns can all serve as useful detection signals.

Security teams should also examine whether their mail filtering systems normalise Unicode before applying keyword rules. Regular expressions and detection signatures should be designed to account for invisible characters being inserted between visible letters.

Monitoring trusted marketing platforms is equally important. Messages originating from legitimate infrastructure should not automatically be considered safe, particularly when other indicators such as newly registered sender domains, suspicious financial themes or unusual link behaviour are present.

AI Is Making Both Phishing Creation and Phishing Evasion Easier

There are really two AI-related stories happening here. The first is that AI-powered marketing and content-generation tools can help attackers create convincing phishing messages at enormous scale. The second is that techniques discovered through AI security research are now being repurposed to evade conventional security controls.

Together, these developments make phishing campaigns increasingly adaptive. Attackers can generate more personalised messages, test alternative wording automatically and introduce technical obfuscation designed to defeat specific detection methods.

Defenders therefore need to evolve just as quickly. Email security cannot depend on one signature, one keyword list or one reputation score. Effective defence increasingly requires several layers of detection working together.

Final Thoughts

Microsoft's discovery of a multi-million-message phishing campaign using invisible Unicode characters is a good example of how small technical tricks can become powerful when combined with automation and scale. Recipients see perfectly ordinary financial terms, while the underlying character sequence is deliberately manipulated to interfere with email filters.

The campaign also demonstrates how techniques associated with AI security are beginning to influence traditional cybercrime. ASCII smuggling, Unicode manipulation, AI-generated content and trusted marketing infrastructure can all be combined into a single operation that looks increasingly similar to legitimate business communication.

For security teams, the lesson is clear: what an email looks like is no longer necessarily what the underlying system is processing. Normalising text, examining hidden characters, monitoring behavioural patterns and treating reputable infrastructure as potentially abusable are becoming increasingly important.

For users, the advice remains simpler. A polished email should never be mistaken for a trustworthy one. When a message unexpectedly involves loans, funding, credentials or sensitive financial information, verification should happen through an independent channel before anything is clicked, submitted or approved.