Phishers Hide “Funding” With Invisible Unicode

Microsoft reported a real, high-volume phishing campaign (up to millions of emails per day) that hid key “loan/funding” lure words using invisible Unicode characters to slip past email filters. The emails used disposable finance-themed domains and were often routed through ActiveCampaign link-tracking domains, making them look more like legitimate marketing traffic.

Key findings

• Microsoft observed a “high-volume phishing campaign” using invisible Unicode tag characters to bypass email filters.
• Attackers split finance lure words (example: “funding”) with invisible characters so the text looks normal to recipients but won’t match filter signatures.
• The campaign ran at very large scale (estimated weekday volumes between 1 and 2.37 million messages) and followed a weekday-heavy cadence.
• The activity used “hundreds of disposable, finance-themed sender domains” and loan/line-of-credit/advance-funding style lures.
• Links were routed through ActiveCampaign click-tracking domains (acemlnd[.]com and activehosted[.]com), potentially benefiting from the reputation of a legitimate marketing platform.

Who’s being targeted

• Commonly targeted roles: Finance, Accounting, Executives, Small business support/sales teams, Anyone who reviews inbound loan/credit offers.
• Affected industries: Small businesses (loan applicants), Finance (lending/loans), Any organization receiving business-loan themed email.
• Attack channels: email.
• Impersonated: A finance lender or funding provider using a finance-themed domain, An SBA-loan related sender using a marketing platform workflow.

Awareness takeaways

• Treat unsolicited loan/credit/funding emails as high risk, verify with a trusted source before clicking or sharing business information.
• Be cautious when links are routed through third-party click trackers; a reputable platform can still be abused by attackers.
• Don’t assume “normal-looking” text is safe, attackers can use invisible characters to evade filtering and detection.

Red flags to watch for

• Too-good-to-be-true loan/advance funding language that pressures fast action
• Sender domain is a disposable, finance-themed lookalike rather than a known lender
• Links are routed through tracking domains (e.g., acemlnd[.]com / activehosted[.]com)
• Unsolicited request for sensitive business/financial data
• Email appears like bulk marketing traffic rather than a known, verified SBA communication path
• Use of AI-generated/phishing-style web flows that look tailored to the recipient