Researchers observed a high-volume phishing campaign that inserted invisible Unicode tag characters into financial terms such as “funding,” “loan,” and “credit.” To recipients, the messages looked normal.
However, the hidden characters split the words at the processing level, potentially preventing simple keyword-based filters from recognizing suspicious language.
For example, the visible word “funding” could contain an invisible Unicode character between “fun” and “ding.” A user would still read the complete word, but a detection tool looking for the exact text string “funding” may fail to match it.
ASCII smuggling is the use of non-rendering Unicode characters to conceal text inside apparently normal content.
The technique commonly abuses the Unicode Tags block, ranging from U+E0000 to U+E007F. These characters are largely invisible in standard fonts and email applications.
ASCII Smuggling Evades Filters
The method became well known through AI prompt-injection research. Attackers can hide instructions in emails, web pages, or documents that humans cannot see but an AI assistant may process if it reads the raw content.
Those hidden instructions could attempt to influence an AI system into exposing information or performing unauthorized actions.
In this phishing campaign, however, the attackers did not appear to use the characters to conceal instructions for AI models. Instead, they used a single invisible tag character, including U+E0020, to break up financial lure words and make them harder for filters to identify.
Microsoft said the activity was first discovered through a hunting signature created to identify hidden prompt-injection content in emails.
Telemetry showed a sharp increase in detections beginning February 9, 2026. The campaign peaked at more than 2.3 million messages on one day and remained active on weekdays for about three months.
The operation largely paused on weekends, suggesting scheduled bulk-email infrastructure. Microsoft linked the activity to a broader Small Business Administration-themed phishing campaign that used finance-themed disposable sender domains.
The phishing emails promoted business loans, funding offers, credit lines, and advance-funding services. Sender domains combined terms such as “capital,” “funding,” “loan,” “business,” “boost,” and “growth” to create rotating brand-like names.
Many messages were delivered through infrastructure associated with ActiveCampaign, a legitimate email-marketing platform.
The emails used the platform’s tracking domains, including acemlnd[.]com and activehosted[.]com, to rewrite outbound links.
Microsoft stressed that these shared domains and IP ranges should not be blocked as standalone indicators because legitimate customers also use them.
Indicators of Compromise
| Indicator | Type | Description / Detection Use |
|---|---|---|
U+E0000–U+E007F | Unicode content pattern | Unicode Tags block characters embedded in email subject lines or bodies to hide or split suspicious words |
U+E0020 | Unicode character | Invisible Unicode TAG SPACE observed inserted inside phishing keywords, such as fun<U+E0020>ding |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
