A high-volume phishing operation was reported by Microsoft to be using invisible Unicode tag characters to bypass email filters. The technique, described as ASCII smuggling, hides instructions inside ordinary-looking text by interleaving non-rendering characters in words such as “funding,” making the message appear normal to recipients while defeating literal or pattern-based filters.
The attackers are exploiting the Unicode Tags block (notably U+E0000 to U+E007F) to split terms and evade detection, with the aim of delivering mass phishing alongside AI-assisted text generation.
Microsoft and FireEye (via the Fortra FIRE team) note that the phishing campaign has circulated hundreds of disposable finance-themed sender domains and relays outbound links through ActiveCampaign, complicating reputation-based filtering. Weekday volumes were estimated at 1–2.37 million messages, with a peak around 26 February 2026, and the activity followed a three‑month high before dropping after 15 May 2026.
The campaign appears tied to broader phishing efforts using ActiveCampaign’s AI-enabled features and leverages lures linked to business loans and funding. The article lists top sender domains such as guardiangrowthfunding[.]com and digitalcapitalboost[.]com, and highlights how filters and detectors may miss these interleaved characters.