Ethical Hacking News
A new phishing campaign has been uncovered by Microsoft, which is using invisible Unicode characters to evade email filters and evade detection. The campaign, which started in early February 2026, highlights the complexity and adaptability of modern phishing techniques.
Microsoft has uncovered a phishing campaign using invisible Unicode tag characters to bypass email filters. The campaign, starting in early February 2026, uses "ASCII Smuggling" to conceal messages in normal-looking text. The attackers are using a deprecated Unicode Tags block to create a sophisticated and convincing phishing campaign. The campaign is a high-volume operation, sending 1-2.37 million emails per weekday. The attackers are using disposable, finance-themed sender domains to mimic legitimate business patterns. Microsoft is warning users to be cautious and report suspicious activity to authorities.
A recent phishing campaign has been uncovered by Microsoft, which has been utilizing invisible Unicode tag characters to bypass email filters and evade detection. The campaign, which is believed to have started in early February 2026, has been identified as a prime example of how threat actors are adapting AI-era evasion techniques to traditional phishing and spam campaigns.
According to Microsoft, the phishing campaign in question is using a technique known as "ASCII Smuggling," which involves inserting invisible or non-rendering Unicode characters into seemingly harmless text. This technique allows the attackers to conceal messages or instructions within the text, making it appear normal to human users, but still allowing email filters and AI language models to ingest the content.
The use of invisible Unicode characters in the phishing campaign is particularly noteworthy, as it highlights the complexity and adaptability of modern phishing techniques. The attackers have chosen to focus on the Unicode Tags block, which contains a range of characters that are intended for language tagging but are now largely deprecated. This choice of block has allowed the attackers to create a sophisticated and convincing phishing campaign that can bypass even the most advanced email security controls.
The phishing campaign itself has been identified as a high-volume operation, with estimated weekday volumes reaching anywhere between 1 to 2.37 million messages. The campaign is believed to be tied to a broader phishing campaign that weaponized the ActiveCampaign marketing and automation platform to distribute thousands of AI-generated phishing emails targeting Small Business Administration (SBA) loan applicants.
The attackers have also been using hundreds of disposable, finance-themed sender domains to distribute the phishing emails. These domains are designed to mimic legitimate business loan, line-of-credit, and advance-funding phishing patterns, making it difficult for users to distinguish between legitimate and malicious emails.
Microsoft has noted that the use of invisible Unicode characters in the phishing campaign is particularly problematic, as it can allow attackers to create convincing and targeted phishing campaigns that can bypass even the most advanced security controls. The company has also highlighted the importance of reputation-based filtering, which can be complicated by the use of shared sending services like ActiveCampaign.
In response to the phishing campaign, Microsoft has issued a warning to users, advising them to be cautious when receiving emails from unknown or suspicious senders. The company has also encouraged users to report any suspicious activity to the relevant authorities and to take steps to protect themselves from phishing attacks.
The discovery of this phishing campaign highlights the ongoing evolution of modern phishing techniques and the importance of staying vigilant in the face of emerging threats. As threat actors continue to adapt and improve their tactics, it is essential that security professionals and users remain aware of the latest threats and take steps to protect themselves from phishing attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Novel-Phishing-Technique-How-Invisible-Unicode-Characters-are-Being-Used-to-Evade-Email-Filters-ehn.shtml
https://thehackernews.com/2026/09/phishing-campaign-sends-millions-of.html
Published: Fri Sep 4 12:58:32 2026 by llama3.2 3B Q4_K_M
