Microsoft reported a real phishing email campaign that hid invisible Unicode “tag” characters inside common financial-phishing keywords. The emails looked normal to recipients (e.g., loan/credit offers) but the hidden characters changed what spam filters and machine-learning classifiers “saw,” helping the messages bypass detection at large scale.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “We offer fast business funding, loan, credit line options.” Looks boring, right? But Microsoft found millions of these where attackers hid invisible Unicode tag characters inside words like “funding,” “loan,” and “credit” so filters don’t recognize them. So your inbox and even AI tools might miss it, but you still see a random, pushy offer for a business loan or credit line you never asked for. If you get an unsolicited business funding, loan, or credit line email, don’t trust the filters, treat it as phishing and report it immediately.
Microsoft reports real-world Star Blizzard phishing campaigns where victims who engage with an initial email receive a follow-up message containing a password-protected ZIP/RAR attachment. The attachment chain hides a malicious shortcut disguised as a PDF, opening a decoy file while quietly…
Microsoft reports a real, large-scale email campaign that impersonated company executives and ServiceNow to pressure accounts payable teams into sending nearly $50,000 via ACH/bank transfer. The emails bundled a CEO “approval,” a fake ServiceNow-branded invoice, and a fabricated forwarded thread to…
A Russia-linked group (TA488) abused a stored XSS flaw in on‑prem Microsoft Exchange Outlook Web Access (OWA) so that simply opening a specially crafted HTML email could run attacker JavaScript inside the victim’s logged-in webmail session. The campaign used business-themed subject lines and hid…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
Researchers say North Korea-linked Kimsuky is using AI tools to improve phishing campaigns that deliver malware through ZIP files containing malicious Windows shortcut (LNK) files. The lures are designed to look like legitimate international event materials, research reports, or meeting requests,…
Russian-linked threat actors sent generic-looking informational emails that required no clicking, but simply opening them in vulnerable Outlook Web Access (OWA) could trigger a hidden exploit. The campaign targeted government and multiple industries, then installed a stealthy browser-based implant…
