Invisible Unicode Phishing Splits Words to Evade Email Filters

Microsoft has uncovered a high-volume invisible Unicode phishing campaign that hid non-rendering characters inside financial lure words. The technique made words appear normal to recipients while disrupting email filters that relied on literal keyword or regex matches.

Microsoft observed the technique at scale beginning in February 2026, with millions of signature hits recorded on peak weekdays. The campaign demonstrates an unusual crossover. A technique associated with hiding instructions from AI systems was repurposed for conventional email-filter evasion.

How invisible Unicode phishing splits financial lure words

The campaign used characters from the Unicode Tags block, U+E0000 to U+E007F. This block contains special-use tag characters, including characters corresponding to printable ASCII characters, that typically do not render visibly in user interfaces.

Attackers inserted these hidden code points inside common financial terms. Microsoft provided an example involving the word funding, where an invisible tag character appeared between visible portions of the word.

The recipient would still perceive the expected financial term, but the underlying character sequence was different. As a result, a detector matching the unnormalized literal string funding would not find the contiguous keyword. A regex that does not account for interleaved invisible code points could face the same problem.

This distinction matters because the technique targeted parsing and detection logic, rather than human perception.

Microsoft also identified U+E0020 as a character specifically used within the observed campaign. Legitimate email rarely contains characters from this range, according to its analysis.

Why this ASCII smuggling campaign stands out

ASCII smuggling is not limited to phishing.

Microsoft uses the term ASCII smuggling for techniques that use invisible or non-rendering Unicode characters to hide content inside text that appears normal. Researchers have previously examined similar techniques in the context of prompt injection and AI systems.

In this campaign, however, the sampled messages did not use the characters to hide instructions for an AI assistant. Attackers instead inserted them into financial keywords to interfere with email-filter parsing.

Microsoft also observed the technique at significant scale.

Microsoft telemetry showed a sharp rise in its ASCII-smuggling hunting signature beginning February 9, 2026. Weekday activity ranged from approximately 1 million to 2.37 million messages, with the highest volume recorded on February 26.

Activity followed a pronounced weekly pattern. Volumes fell sharply on weekends before returning on Mondays. By late March, weekday volumes had declined by roughly 80%. The high-volume use of this exact technique dropped sharply after May 15.

Importantly, these dates describe Microsoft’s observations of the Unicode-tag technique, not the complete lifespan of the broader phishing operation.

Disposable domains met trusted marketing infrastructure

Unicode obfuscation was only one component of the campaign.

Microsoft identified hundreds of finance-themed sender domains built from terms associated with loans, capital, funding and related financial services. The messages used business-loan, line-of-credit and advance-funding themes.

Microsoft connected the activity to a broader campaign delivered through ActiveCampaign. The Unicode-tag activity represented a phase within that wider operation rather than its beginning.

Links were also routed through ActiveCampaign’s click-tracking infrastructure, including acemlnd[.]com and activehosted[.]com. Because these domains belong to legitimate infrastructure, their presence alone should not be treated as a malicious indicator.

Microsoft noted that abuse of shared sending services can complicate reputation-based filtering. Traffic originating from infrastructure with established reputation and authentication may resemble legitimate marketing activity.

According to The Hacker News, ActiveCampaign said its tests gave messages containing invisible Unicode characters the same moderation verdict as their unobfuscated equivalents. It also said heavy use of the technique is treated as a suspicious signal.

What the Microsoft findings actually confirm

The distinction between filter evasion and successful compromise is important.

Microsoft confirmed that attackers used Unicode tag characters to disrupt literal keyword detection. It also documented the campaign’s scale, infrastructure patterns and financial lures.

However, the published Microsoft analysis does not establish that these specific Unicode-obfuscated messages successfully stole credentials, downloaded malware or compromised endpoints.

Therefore, defenders should not treat the campaign as evidence that invisible Unicode itself creates an endpoint compromise path.

Instead, the research demonstrates a preprocessing problem. Security controls that inspect text should account for invisible characters before relying on exact keyword or signature matches.

Microsoft also noted that Defender for Office 365 detected most messages through layered protections, rather than depending exclusively on one Unicode-specific signal.

How enterprises can respond to invisible Unicode phishing

Email security teams should review how their detection pipelines process Unicode before applying content-based rules.

Useful defensive measures include:

1. Normalize text before inspection. Detection pipelines should account for invisible or non-rendering characters before applying keyword and pattern matching.
2. Detect unusual Unicode Tags usage. Microsoft notes that legitimate email rarely contains characters from this block, with limited exceptions such as certain flag emoji sequences.
3. Avoid single-signal detection. Sender reputation or literal keyword matching alone may miss messages designed around preprocessing weaknesses.
4. Inspect surrounding infrastructure and content. Sender-domain patterns, message themes and unusual Unicode usage can provide additional context.
5. Treat legitimate shared infrastructure carefully. Marketing or cloud infrastructure should not become a malicious IOC solely because attackers abused it.
6. Investigate activity after suspicious interactions. If users interact with a suspected phishing message, security teams can examine endpoint and identity telemetry for subsequent suspicious behavior.

The objective is not simply to block one code point. Defenders need parsing and normalization controls that reduce the effectiveness of similar character-level obfuscation.

Where Hexnode fits after a suspicious phishing interaction

While email security controls operate at the gateway layer to normalize Unicode, endpoint controls become relevant if a user clicks an evasive link and subsequent suspicious endpoint activity occurs.

The relevant Hexnode capabilities span endpoint threat investigation and response, device management and compliance, and Conditional Access.

Investigate suspicious endpoint activity with Hexnode XDR

If investigation indicates suspicious activity on a managed endpoint after a phishing interaction, Hexnode XDR can provide endpoint visibility and threat-hunting capabilities.

Hexnode currently documents cross-platform visibility for Windows and macOS, query-based threat hunting, device isolation, malicious process termination and file quarantine.

Featured resource

Why XDR Is Stronger With UEM

Explore how combining endpoint management with threat detection and response can strengthen enterprise security operations.

Download the whitepaper

Maintain endpoint posture with Hexnode UEM

Hexnode UEM provides another supporting control at the device-management layer.

Administrators can use compliance policies to identify managed devices that fail defined organizational requirements. Hexnode supports compliance configuration across platforms including Windows and macOS.

Hexnode also provides patch and update management across supported platforms. Windows and macOS use its advanced patch-management workflows, while capabilities differ on other platforms.

These UEM capabilities support endpoint security posture through device compliance and patch-management workflows.

Apply device-aware access controls with Hexnode IdP

Device compliance can inform access decisions through two distinct Hexnode-supported approaches.

With Microsoft Entra Conditional Access, Hexnode UEM can report compliance information for supported Android, iOS, and macOS 11+ devices to Microsoft Entra ID. Microsoft Entra Conditional Access can then use that compliance status when deciding whether to grant or block access.

Separately, Hexnode IdP Conditional Access provides native access rules based on user identity, device compliance, and security context. This allows organizations using Hexnode IdP to incorporate device compliance directly into their access policies.

What invisible Unicode phishing means for defenders

The Microsoft campaign demonstrates that sophisticated-looking evasion does not always require a new exploit.

Here, attackers manipulated how machines parsed text while leaving the recipient’s visual experience largely unchanged.

For enterprises, the immediate lesson is specific: email inspection pipelines should normalize and analyze invisible Unicode before relying on literal content matches.

Invisible Unicode phishing is therefore less about defeating one security product and more about exploiting the gap between what a person sees and what a detection system parses.