GoKawiilMicrosoft flags phishing campaign hiding invisible Unicode characters in finance-themed emails
Microsoft researchers identified a large phishing operation that inserts invisible Unicode 'Tags' characters inside finance-related keywords—splitting words like 'funding' into fragments—to slip past email filters that scan for suspicious terms. The campaign peaked at 2.37 million daily messages in late February and, despite a drop in volume by May, remains active, with Defender for Office 365 tracing it to 148 finance-themed sender domains.
GoKawiil's interpretation of the reporting above, not reported fact.
This marks a shift of ASCII smuggling, previously seen in AI prompt-injection attacks, into mainstream phishing, showing how attackers adapt AI-evasion tricks for traditional email fraud. Even though Microsoft says its Defender system still caught over 99% of these messages using other signals like sender reputation, the technique highlights a growing weakness in keyword-based filtering that other security tools may not compensate for.
- Invisible Unicode Tags characters are being used to break up finance-related keywords and evade spam filters.
- The campaign spanned finance-themed sender domains using terms like 'funding,' 'loan,' and 'credit,' peaking at 2.37 million messages daily.
- Despite high message volumes, Microsoft's Defender still detected over 99% of the emails through non-keyword-based signals.
Yubico YubiKey 5C NFC Security Key — When phishing emails slip past filters using invisible Unicode tricks, a hardware key is the backstop that stops stolen passwords from becoming stolen accounts. The YubiKey 5C NFC plugs into USB-C or taps NFC phones for phishing-resistant sign-ins across Microsoft, Google, and many other accounts. It's a tiny, batteryless thing to keep on your keychain and forget about until it saves you.
See Yubico YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-06
Published there as: “Attackers conceal phishing lures using invisible Unicode characters”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.