Microsoft researchers reported a real, high-volume phishing campaign that used invisible Unicode “tag” characters to break up finance-related lure words (like “funding”) so email filters wouldn’t detect them. The emails looked normal to recipients but contained hidden characters in the underlying text, helping the campaign send millions of finance-themed phishing messages over several months.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
There’s a new finance phishing wave where the scam text looks normal to you, but not to our filters. Microsoft caught a campaign sending millions of emails that secretly split words like 'funding' with invisible Unicode tag characters so keyword filters miss them. These come from random loan domains, promise fast business funding or a line of credit, and push you to click through and fill out an application with your business and identity details. If you get an unsolicited business funding or line-of-credit email from an unknown domain, don’t click, report it to security and delete it.
Microsoft reports criminals are using “ASCII smuggling” (invisible Unicode tag characters) to hide finance-related phishing keywords inside emails so detection rules miss them. The campaign used many disposable, finance-themed sender domains and was relayed through infrastructure tied to the…
Microsoft reported a real, high-volume phishing campaign (up to millions of emails per day) that hid key “loan/funding” lure words using invisible Unicode characters to slip past email filters. The emails used disposable finance-themed domains and were often routed through ActiveCampaign…
Researchers observed a surge in short "request for quotation" (RFQ) emails that look like routine business inquiries to sales and procurement teams. After the victim replies, attackers send a follow-up link disguised as project documents or a procurement portal that leads to a fake Microsoft…
Microsoft observed a ClickFix campaign where compromised websites cache a hidden payload in the victim’s browser, then trick the user into pasting a command (often via Win+R) that executes what’s already on the device. The method helps attackers hide the payload and get around Windows “Run”…
A weekly incident roundup describes multiple real-world attacks where criminals used "AI" branding to trick people into handing over passwords/MFA codes or running harmful PowerShell commands. The write-up includes two practical, repeatable social-engineering workflows: fake AI-platform login pages…
This weekly bulletin highlights multiple real-world incidents, including phishing and impersonation campaigns. Notably, researchers found attackers using malicious “Custom GPTs” on ChatGPT to redirect victims to a Google Sites page and trick them into running commands that install remote-access…
