AI Generated Image
Attackers conceal phishing lures using invisible Unicode characters
BleepingComputer • • technology
Key Points:
- Threat actors have employed ASCII smuggling in phishing campaigns by inserting invisible Unicode characters into finance-related keywords, allowing them to bypass email security filters that rely on word lists.
- Microsoft identified a large-scale campaign peaking at 2.37 million daily phishing emails in late February 2026, which gradually declined by May but remains active.
- The attackers used invisible Unicode characters from the Tags block (U+E0000–U+E007F) to split keywords like “funding” into undetectable segments, evading filters while promoting business funding, loans, and credit services.
- Despite the technique’s effectiveness, Microsoft Defender still detected over 99% of the messages using other signals such as sender reputation and IP checks.
- Microsoft advises defenders to normalize or strip invisible Unicode characters before applying detection methods and recommends the same approach to mitigate AI prompt-injection risks in email content.
