Microsoft reports criminals are using “ASCII smuggling” (invisible Unicode tag characters) to hide finance-related phishing keywords inside emails so detection rules miss them. The campaign used many disposable, finance-themed sender domains and was relayed through infrastructure tied to the legitimate email-marketing platform ActiveCampaign.
This campaign relied on a technique known as ASCII smuggling, where attackers embed invisible Unicode tag characters inside otherwise ordinary finance keywords. A word like "funding" could be split apart with a hidden character in the middle, so the email still reads normally to a human but no longer matches the exact keyword or signature that a filter is scanning for. The lures themselves followed familiar finance phishing patterns, including business loan, line-of-credit, and advance-funding offers, the kind of messaging often tied to fraud or credential-harvesting funnels.
The technique succeeded because it targets a mismatch between how humans and machines read text. A person sees a clean, legible word. A keyword-matching filter sees a broken string that fails to trigger a known signature. Compounding this, the campaign used hundreds of disposable, finance-themed sender domains, making it harder for defenders to build a reliable blocklist. Messages were also relayed through infrastructure associated with a legitimate email-marketing platform, which can add a layer of apparent legitimacy to the delivery path.
Because the hidden characters are invisible to the reader, the visual content of the email will not look suspicious on its own. The strongest signals are the behavioral pattern of the campaign and the unsolicited nature of the financial offer.
For individual readers, the primary defense is treating unexpected loan or credit offers as high-risk and verifying them independently before clicking any link or submitting business credentials. Finance, accounts payable, treasury staff, and business owners are the most likely targets given the subject matter of these lures.
For security teams, Microsoft recommends stripping or normalizing Unicode tag characters and other zero-width or invisible code points from email subject and body text before applying spam and phishing content signatures. The same normalization should be applied upstream of any AI system that ingests email content, since hidden characters can otherwise slip through automated analysis just as easily as they slip through traditional filters. Combining this technical control with awareness of the campaign's behavioral fingerprint, bulk sends from disposable domains on a strict weekday schedule, gives defenders a better chance of catching this technique before it reaches an inbox.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a technique where attackers insert invisible Unicode tag characters inside common finance keywords, splitting the word apart so keyword or signature-based filters fail to match it while the text still looks normal to the reader.
The lures resembled business loan, line-of-credit, and advance-funding phishing patterns often associated with fraud or credential-harvesting funnels.
Microsoft recommends stripping or normalizing Unicode tag characters and other zero-width or invisible code points from email subject and body text before applying phishing signatures, and applying the same normalization before AI systems ingest email content.
Defenders should look for bulk volume from churning, finance-themed disposable domains sent on a strict weekday-on/weekend-off schedule.
You get an email: “Pre‑approved funding for your business, line of credit.” Looks boring, legit, finance stuff, right? Behind the scenes, it’s using “ASCII smuggling”, invisible Unicode tag characters jammed inside words like funding, loan, and credit so filters don’t see them, but you do. These come from hundreds of throwaway finance domains, sent like a marketing campaign through platforms like ActiveCampaign, nudging you into a fake loan or line-of-credit “application” to steal credentials. If you get an unexpected loan or line-of-credit offer, don’t click the application link. Instead, go to your bank or lender’s official site yourself or call them to confirm.
Microsoft reported a real, high-volume phishing campaign (up to millions of emails per day) that hid key “loan/funding” lure words using invisible Unicode characters to slip past email filters. The emails used disposable finance-themed domains and were often routed through ActiveCampaign…
Microsoft researchers reported a real, high-volume phishing campaign that used invisible Unicode “tag” characters to break up finance-related lure words (like “funding”) so email filters wouldn’t detect them. The emails looked normal to recipients but contained hidden characters in the underlying…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
Researchers say a Chinese-speaking cybercrime group compromised Brazilian government and education websites and used them as “trusted” entry points to quietly redirect visitors to attacker-run phishing pages. The fake pages impersonated well-known app stores (Google Play, Microsoft Store, Amazon)…
Malwarebytes reports that scammers are increasingly tailoring different scams to the platforms where they work best, like unpaid-toll lures via email/SMS, romance scams via social media, and IRS scams via phone calls. The report highlights heavy brand and celebrity impersonation (including MrBeast)…
The FBI warns attackers are impersonating public figures on messaging apps and email to trick targets into approving a malicious OAuth app. Victims are sent links that lead to real Microsoft or Google login/consent screens, where approving access grants attackers ongoing access to emails and files.…
