Cybercriminals are using invisible Unicode characters to disguise words inside phishing emails, allowing malicious messages to bypass security mechanisms that depend on keywords and pattern matching. The technique demonstrates how attackers can exploit differences between what humans see on a screen and what security software actually processes, creating phishing messages that appear completely normal while containing hidden characters beneath the visible text.
The technique, commonly referred to as ASCII smuggling, uses special Unicode characters that are effectively invisible when displayed to users. Microsoft threat researchers discovered the method being deployed at significant scale in a finance-themed phishing operation that reached as many as 2.37 million messages per day at its peak in late February 2026. Although activity declined substantially after mid-May, Microsoft says the broader phishing campaign has continued.
ASCII smuggling has previously attracted attention because of its potential role in AI prompt-injection attacks. Attackers can encode hidden instructions using Unicode characters from the Tags block, covering the range U+E0000 through U+E007F, allowing text to contain information that is invisible to a person reading it normally. The phishing campaign analyzed by Microsoft applies the same fundamental idea to email-security evasion rather than directly targeting an AI model.
Instead of hiding an entire malicious message, attackers insert invisible Unicode characters inside words likely to trigger security filters. A term such as “funding,” for example, can be internally represented as “fun[invisible character]ding.” A human recipient still sees what appears to be the ordinary word, but software performing a literal comparison against a list containing “funding” may interpret the manipulated string as something different.
This creates a discrepancy between visual representation and machine interpretation. Email filters have historically used combinations of keyword detection, regular expressions, reputation analysis, sender information, URL inspection and increasingly machine-learning models to determine whether messages are suspicious. If one layer of that system expects text to have a predictable underlying representation, invisible characters can interfere with the detection logic without making the phishing message look suspicious to the recipient.
Microsoft observed this technique being used across millions of finance-related emails promoting business loans, funding and credit services. Words commonly associated with the campaign included terms such as “funding,” “capital,” “loan,” “advance” and “credit,” making them obvious candidates for keyword-based detection. By inserting invisible characters inside those terms, the attackers attempted to prevent filters from recognizing them as complete words.
The operation reached considerable scale. Microsoft says the high-volume phase continued for roughly three months following February 9, 2026, before dropping sharply after May 15. The company emphasized that these dates represent the period during which it observed this particular Unicode-based technique in its telemetry, rather than the complete lifetime of the phishing operation, which existed before the technique appeared and continued afterward.
On February 9, Microsoft’s researchers identified a cluster of 148 finance-themed sender domains associated with the operation. Those domains were responsible for approximately 96 percent of the messages detected by new Microsoft Defender for Office 365 hunting logic designed to identify the Unicode-tag signatures associated with the campaign.
The campaign also demonstrates why phishing detection cannot depend on any single indicator. Despite the Unicode manipulation successfully interfering with keyword-oriented detection, Microsoft says Defender still blocked more than 99 percent of the messages using other signals. Sender characteristics, source IP addresses, domains and reputation information provided alternative ways to identify the activity even when the visible language had been technically modified.
This layered approach is particularly important because virtually every individual phishing indicator can eventually be manipulated. Attackers can change wording, rotate domains, compromise legitimate accounts, use reputable cloud infrastructure and modify URLs. Security products therefore attempt to combine many weak and strong signals rather than assuming that one detection mechanism will consistently identify malicious activity.
The infrastructure used to distribute the campaign provides another example of this strategy. The messages were sent through infrastructure associated with ActiveCampaign, a legitimate email-marketing platform used by businesses to distribute campaigns and automate customer communications. Using reputable services can provide attackers with infrastructure that may initially appear less suspicious than mail delivered directly from newly created or obviously malicious servers.
Following Microsoft’s report about abuse of the service, ActiveCampaign said its moderation systems process invisible Unicode characters in the same way as unobfuscated text and consider extensive use of those characters suspicious. This illustrates an important defensive principle: the effectiveness of Unicode-based evasion drops dramatically when systems normalize text before analyzing it.
Normalization essentially attempts to remove the difference between what a human sees and what a security engine examines. If invisible tag characters are removed or converted before keyword detection takes place, a manipulated version of “funding” becomes recognizable as the original word again. The attacker’s additional characters consequently stop providing the desired advantage.
Microsoft recommends that defenders strip or normalize Unicode tag characters and other invisible code points before applying keyword rules, regular expressions or signature-based detection. Unexpected characters from the Unicode Tags block should also be considered a strong anomaly because normal business emails have relatively few legitimate reasons to contain them.
The technique is especially interesting because Unicode was designed to solve an entirely different problem. Modern software needs to represent text from languages and writing systems around the world, along with formatting information, symbols and specialized control characters. The enormous flexibility required to accomplish that goal inevitably creates unusual edge cases that attackers can attempt to weaponize.
Cybersecurity researchers have documented several families of attacks that exploit how text is represented. Homoglyph attacks use visually similar characters from different alphabets to create domains or text that resemble legitimate names, while bidirectional Unicode controls can manipulate how source code or messages appear on screen. Invisible characters represent another variation in which the underlying data contains information that the user cannot easily observe.
These attacks share a common security challenge: visual equivalence does not necessarily mean binary or semantic equivalence. Two strings may look identical on a screen while containing completely different sequences of code points. Security controls that compare raw strings without accounting for Unicode behavior can therefore reach conclusions that differ from those of the person viewing the content.
The growth of AI assistants introduces another reason for organizations to address this problem. Email content is increasingly passed to large language models for summarization, classification, search, automated responses and workflow automation. Hidden Unicode content that is harmless from the perspective of a traditional phishing filter could potentially become an instruction interpreted by an AI system.
Microsoft specifically recommends performing similar Unicode normalization before email content is supplied to AI assistants, helping reduce the possibility that invisible characters could be used for prompt injection. This becomes increasingly important as AI systems move beyond simply summarizing messages and begin taking actions based on their contents.
Consider an AI assistant that can read incoming email, access a calendar, search internal documents and execute business workflows. A hidden instruction embedded inside a message could theoretically be processed by the model even though the employee reviewing the same message cannot see it. If the AI has significant permissions, the difference between visible and machine-readable content becomes a security boundary rather than merely a text-processing curiosity.
This is why indirect prompt injection has emerged as an important concern around agentic AI. The user does not necessarily need to enter the malicious prompt themselves; an AI system may encounter adversarial instructions while reading a webpage, document, email or other external content. Invisible Unicode characters offer attackers another mechanism for hiding those instructions from the person supervising the system.
Organizations integrating AI into email workflows should consequently treat external messages as untrusted input regardless of whether they appear benign to human readers. Sanitization, normalization, content isolation and restrictions on the actions available to AI agents can help prevent an email from becoming an instruction channel into a more powerful automated system.
For conventional email security, the campaign also shows the limitations of relying heavily on language-specific detection. Keyword lists can still provide useful signals, particularly when combined with other indicators, but attackers can manipulate spelling and text representation in countless ways. Invisible characters simply provide a particularly elegant method because the recipient may not notice any manipulation at all.
Behavioral and infrastructure signals can compensate for this weakness. A newly observed domain sending enormous quantities of financial solicitations, for example, can be suspicious regardless of whether the word “funding” is represented normally. Reputation systems, authentication results, sender behavior, URL destinations and message volume can therefore remain effective even when individual words have been obfuscated.
The fact that Defender reportedly detected more than 99 percent of the messages despite the Unicode technique reinforces the value of layered detection. The attackers successfully manipulated one part of the security problem, but they still had to contend with many additional signals generated by their infrastructure and behavior.
Security teams can nevertheless use the campaign as an opportunity to examine their own detection pipelines. Systems that process email, web content, logs or user-generated text should establish whether Unicode normalization occurs before security rules are evaluated. Regular expressions and signatures written without considering invisible characters may contain blind spots that are difficult to identify through ordinary testing.
Detection engineers can also search telemetry for unexpected use of Unicode tag characters. Because these code points should be relatively unusual in normal corporate communication, their presence can provide a high-value signal for investigation, particularly when combined with financial language, suspicious sender infrastructure or other phishing indicators.
The same principle applies beyond email. Security products analyzing chat messages, support tickets, documents, source code, web forms and AI prompts may encounter similar discrepancies between displayed and underlying text. As more automated systems make decisions based on natural-language input, understanding exactly how that input is encoded becomes increasingly important.
For users, the campaign provides another reminder that a phishing email cannot always be identified through obvious spelling mistakes or unusual formatting. The messages involved in this operation could contain words that visually appeared completely ordinary because the malicious manipulation existed at the Unicode level rather than in the visible presentation.
Technical defenses therefore remain essential. Email authentication, reputation analysis, URL protection, attachment scanning, behavioral detection and endpoint security all contribute signals that do not depend entirely on whether suspicious vocabulary appears inside a message. Organizations should combine these controls with user awareness rather than expecting employees to visually detect every sophisticated phishing technique.
The larger significance of ASCII smuggling lies in how little information attackers need to hide to change the behavior of automated defenses. The objective is not necessarily to make malicious content invisible to everyone; it can be enough to make one security mechanism interpret the content differently from the intended victim.
As email filtering and AI-driven security become more sophisticated, attackers will continue looking for these interpretation gaps. Unicode provides a particularly fertile environment because the text displayed to a human is not always an exact representation of the information being processed underneath.
The phishing campaign discovered by Microsoft demonstrates that this is no longer merely a theoretical technique. Millions of messages used invisible Unicode characters in an attempt to evade detection, reaching daily volumes of more than two million messages during the operation’s peak.
For defenders, the response is conceptually straightforward even if implementation requires care: normalize potentially hostile text before trusting it. Whether that text is being inspected by a traditional email filter, a regular expression or a powerful AI agent, security decisions should be based on a representation that minimizes the gap between what machines process and what humans believe they are seeing.