ASCII Smuggling Phishing Campaign: How Invisible Unicode Characters Evaded Email Security in 2026
In February 2026, Microsoft identified a large-scale phishing campaign that peaked at 2.37 million daily messages, employing ASCII smuggling techniques with invisible Unicode characters to evade email security filters. Threat actors inserted Unicode characters from the Tags block (U+E0000–U+E007F) within finance-related keywords, splitting terms like 'funding' into 'fun[invisible character]ding' to bypass traditional word-based detection systems. The campaign utilized 148 finance-themed sender domains and leveraged legitimate ActiveCampaign email marketing infrastructure to deliver business funding and loan-themed lures. While Microsoft Defender caught over 99% of messages through other detection signals, the technique represents a significant evolution in phishing evasion tactics. This incident highlights the growing sophistication of social engineering attacks as threat actors adapt AI prompt injection techniques for traditional phishing campaigns, demonstrating how emerging attack vectors quickly cross over between different threat landscapes.
Kill Chain
