Microsoft reports criminals are using “ASCII smuggling” (invisible Unicode tag characters) to hide finance-related phishing keywords inside emails so detection rules miss them. The campaign used many disposable, finance-themed sender domains and was relayed through infrastructure tied to the legitimate email-marketing platform ActiveCampaign.
This campaign relied on a technique known as ASCII smuggling, where attackers embed invisible Unicode tag characters inside otherwise ordinary finance keywords. A word like "funding" could be split apart with a hidden character in the middle, so the email still reads normally to a human but no longer matches the exact keyword or signature that a filter is scanning for. The lures themselves followed familiar finance phishing patterns, including business loan, line-of-credit, and advance-funding offers, the kind of messaging often tied to fraud or credential-harvesting funnels.
The technique succeeded because it targets a mismatch between how humans and machines read text. A person sees a clean, legible word. A keyword-matching filter sees a broken string that fails to trigger a known signature. Compounding this, the campaign used hundreds of disposable, finance-themed sender domains, making it harder for defenders to build a reliable blocklist. Messages were also relayed through infrastructure associated with a legitimate email-marketing platform, which can add a layer of apparent legitimacy to the delivery path.
Because the hidden characters are invisible to the reader, the visual content of the email will not look suspicious on its own. The strongest signals are the behavioral pattern of the campaign and the unsolicited nature of the financial offer.
For individual readers, the primary defense is treating unexpected loan or credit offers as high-risk and verifying them independently before clicking any link or submitting business credentials. Finance, accounts payable, treasury staff, and business owners are the most likely targets given the subject matter of these lures.
For security teams, Microsoft recommends stripping or normalizing Unicode tag characters and other zero-width or invisible code points from email subject and body text before applying spam and phishing content signatures. The same normalization should be applied upstream of any AI system that ingests email content, since hidden characters can otherwise slip through automated analysis just as easily as they slip through traditional filters. Combining this technical control with awareness of the campaign's behavioral fingerprint, bulk sends from disposable domains on a strict weekday schedule, gives defenders a better chance of catching this technique before it reaches an inbox.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a technique where attackers insert invisible Unicode tag characters inside common finance keywords, splitting the word apart so keyword or signature-based filters fail to match it while the text still looks normal to the reader.
The lures resembled business loan, line-of-credit, and advance-funding phishing patterns often associated with fraud or credential-harvesting funnels.
Microsoft recommends stripping or normalizing Unicode tag characters and other zero-width or invisible code points from email subject and body text before applying phishing signatures, and applying the same normalization before AI systems ingest email content.
Defenders should look for bulk volume from churning, finance-themed disposable domains sent on a strict weekday-on/weekend-off schedule.
You get an email: “Pre‑approved funding for your business, line of credit.” Looks boring, legit, finance stuff, right? Behind the scenes, it’s using “ASCII smuggling”, invisible Unicode tag characters jammed inside words like funding, loan, and credit so filters don’t see them, but you do. These come from hundreds of throwaway finance domains, sent like a marketing campaign through platforms like ActiveCampaign, nudging you into a fake loan or line-of-credit “application” to steal credentials. If you get an unexpected loan or line-of-credit offer, don’t click the application link. Instead, go to your bank or lender’s official site yourself or call them to confirm.
Microsoft reported a real, high-volume phishing campaign (up to millions of emails per day) that hid key “loan/funding” lure words using invisible Unicode characters to slip past email filters. The emails used disposable finance-themed domains and were often routed through ActiveCampaign…
Microsoft researchers reported a real, high-volume phishing campaign that used invisible Unicode “tag” characters to break up finance-related lure words (like “funding”) so email filters wouldn’t detect them. The emails looked normal to recipients but contained hidden characters in the underlying…
Researchers observed a surge in short "request for quotation" (RFQ) emails that look like routine business inquiries to sales and procurement teams. After the victim replies, attackers send a follow-up link disguised as project documents or a procurement portal that leads to a fake Microsoft…
Microsoft observed a ClickFix campaign where compromised websites cache a hidden payload in the victim’s browser, then trick the user into pasting a command (often via Win+R) that executes what’s already on the device. The method helps attackers hide the payload and get around Windows “Run”…
GhostAction attackers sent a fake GitHub security alert to an open-source maintainer, claiming a login from Moscow and directing the victim to secure their account. The fake site stole the victim’s password and two-factor code, then silently approved a powerful GitHub OAuth connection that let the…
Barracuda reports attackers are abusing fake CAPTCHA pages as a “trust step” to push victims into credential theft, malware downloads, and enabling malicious browser notifications. In some “ClickFix” variants, the CAPTCHA flow tricks users into pasting and running a command on their own Windows…
