Microsoft has uncovered a months-long phishing campaign that fragments financial keywords with invisible Unicode characters, thereby bypassing classic spam filters. The technique, called ASCII-smuggling, originally comes from security research on language models. Criminals used it in several million emails between February and May 2026.
Invisible characters fragment keywords
As described by the Microsoft Security Blog, the attackers insert characters from the so-called Unicode tags block (U+E0000 to U+E007F) into words like “financing” or “loan.” A writing system does not render them, and recipients see a normal word – filters that search for the exact keyword no longer recognize the fragmented character string. The tags block was originally intended for language tagging and exists as an invisible shadow copy of the printable ASCII character set.
The emails posed as loan offers and pre-financing deals and specifically targeted applicants for working-capital loans from the US development bank SBA – a target group that is already expecting emails from unfamiliar financing providers and therefore tends to overlook warning signals. They went out via around 150 finance-themed sender domains, technically routed through the legitimate marketing platform ActiveCampaign. The platform stated that it had tested the specific technique against its own content checks – it provided no advantage over unobfuscated messages, and a high share of invisible characters is treated internally as a suspicion signal.
Campaign follows a strict weekly rhythm
The wave of attacks began in early February 2026 with around 21,000 messages and grew to more than 1.3 million within a single day. On peak days, Microsoft counted over two million messages before the volume subsided again by mid-May. The rhythm stood out: on weekdays, the mailings ran at full capacity, while on weekends they nearly stopped entirely – a sign of automated sending infrastructure tuned to ordinary office hours, which lets it blend into the mass of regular business mail.
Despite the obfuscation, Microsoft Defender for Office 365 intercepted more than 99 percent of the messages – not primarily through the hidden characters themselves, though, but through domain reputation, automated link checks, and bulk-mail pattern detection. The telltale characters mainly served as an additional, after-the-fact detection feature.
Sender domains such as guardiangrowthfunding, digitalcapitalboost, or advancefundingboost stood out – interchangeable word combinations of growth, capital, and advance, the kind legitimate financial service providers also use. That everyday plausibility complicates purely content-based detection and explains why Microsoft instead relies on sending-behavior patterns.
Trick moves from AI research into classic phishing
ASCII-smuggling was previously known mainly as a way to attack language models: crafted instructions hidden from humans in documents or emails are meant to steer AI assistants into unwanted actions, a technique experts call prompt injection. A five-paper roundup on beckmann.ai recently documented how one model’s safety training could be bypassed in 93 percent of attempts using ASCII art disguised as art criticism. The campaign described here shows that criminals are now aiming the same character-trick idea at human inboxes and classic text filters, independent of AI systems.
Microsoft advises defenders to strip tag characters before matching them against detection rules and to treat their presence outside known legitimate uses, such as flag emoji, as an anomaly by default. Normalizing text before it reaches AI systems is worthwhile too, to defuse prompt-injection attempts in advance. Similar to the recently reported CSS trick against webmail providers, this again shows how attackers deliberately exploit the gap between what an inbox displays and what filters actually process.
Whether criminals will next aim the technique more precisely at corporate inboxes with AI-assisted pre-sorting remains open – there, invisible characters could mislead not just classic filters but also the summarizing AI assistants themselves that pre-screen incoming mail for employees.
