Invisible Unicode Characters Are Hiding Phishing Lures

The word is "funding." You read "funding." Your mail filter reads "fun" and then "ding," two harmless fragments separated by a character that has no glyph, occupies no space, and renders as absolutely nothing on every screen it touches. One code point, dropped into the middle of a noun, and a keyword rule written years ago stops firing. Microsoft watched attackers do this several million times a day for three months.

Key Takeaways

• Microsoft published research on September 3, 2026 documenting a phishing campaign that used the Unicode Tags block (U+E0000 to U+E007F) to fragment finance keywords and evade text matching, per the Microsoft Security Blog.
• Daily volume of email containing tag block characters went from roughly 21,000 on February 8, 2026 to about 1.3 million the next day, peaking near 2.3 million and staying elevated on weekdays until mid May.
• The single character doing most of the work was U+E0020, TAG SPACE, inserted inside words like funding, capital, loan, advance and credit.
• Roughly 148 disposable finance themed domains relayed the campaign through the ActiveCampaign marketing platform, with about 92% of the volume leaving a single /24 network block.
• Microsoft says layered signals still flagged over 99% of the messages, which means the evasion worked against keyword rules and failed against everything else.

What Is ASCII Smuggling?

ASCII smuggling is the practice of hiding readable text inside a string using Unicode characters that software processes but no font draws. The main vehicle is the Unicode Tags block, a range of 128 code points from U+E0000 to U+E007F that shadows printable ASCII one for one: U+E0041 stands in for "A", U+E0061 for "a", U+E0020 for a space. You can read the block's official code chart from the Unicode Consortium if you want the full table.

The block was originally specified for language tagging and has been deprecated for that purpose for decades. What survived is the useful part for an attacker: a full alphabet that copies, pastes, transmits, and parses like any other text while being completely absent from the rendered page.

Security researcher Johann Rehberger popularized the term and built the tooling. His ASCII Smuggler write up on Embrace The Red in 2024 showed how to encode an entire hidden instruction into an invisible payload, and his follow up work demonstrated exfiltrating personal data out of Microsoft Copilot through the same channel. For two years this stayed an AI security curiosity. It is not one anymore.

How Does One Invisible Character Defeat a Keyword Filter?

Because a keyword filter compares byte sequences, and inserting a code point changes the byte sequence without changing what a human sees.

Write the regex /business funding/i and it will match the plain string every time. Now put U+E0020 between the "n" and the "d". The rendered subject line is byte for byte identical to the reader's eye. The regex sees a string it has never encountered, scores it as neutral, and moves on. Nothing was encrypted, nothing was obfuscated in any classical sense, and no encoder was required beyond a text editor that tolerates the code point.

The damage extends past literal matching. Machine learning classifiers tokenize before they score, and an unknown code point mid word tends to shatter one token into several unfamiliar ones, which dilutes whatever weight the model had learned for the original term. As The Register noted in its coverage, this is an old evasion idea wearing new clothes: the homoglyph and zero width space tricks that plagued spam filters a decade ago, upgraded to a character class most parsers still forget to normalize.

The Telemetry Tells a Boring, Useful Story

Microsoft's hunting signature for tag block characters sat at a baseline most days: a few thousand hits, mostly noise. On February 9, 2026, it registered about 1.3 million. The day before, it had seen roughly 21,000. That is a jump of more than sixty times, overnight, with no gradual ramp.

Weekday volume then held between one and 2.3 million messages for about three months before falling off after May 15, 2026. Sundays were near zero. Whoever ran this kept office hours. Take the conservative end of Microsoft's own range across roughly sixty five weekdays and the campaign plausibly moved north of 65 million messages, which for scale is more email than the entire population of France receives addressed to them in a day.

The infrastructure was equally unromantic. Around 148 throwaway domains, assembled from a vocabulary of about 28 finance flavored word tokens (advance, boost, capital, catalyst, digital), relayed through the legitimate ActiveCampaign marketing platform. About 92% of the traffic left one /24 address block belonging to that platform's egress space. Reporting from BleepingComputer pegged a single top domain, guardiangrowthfunding.com, at 30,442 hits on the opening day alone.

Why Did an AI Security Hunt Catch a Spam Campaign?

Because the signature was built to find hidden prompt injections aimed at AI assistants, and the phishers happened to be using the identical character range for a completely different purpose.

That detail is the actual story, and most coverage buried it under the message counts. Microsoft wrote the hunt as part of the prompt injection protection now shipping in Defender for Office 365, which entered public preview in July 2026 and went generally available in early September. The expectation was to catch instructions hidden from humans and visible to models. What came back was a finance spam operation splitting the word "loan."

Techniques used to flow from criminal forums toward research. This one flowed the other way. That is the third time in about four months that invisible Unicode has shown up in our reporting for a different reason each time: the Gemini for Workspace flaw that let hidden instructions rewrite a summary in May, Unicode steganography found embedded in Claude Code output in July, and now bulk filter evasion. Same character block, three unrelated motives.

What This Means for Your Inbox

Nothing about this technique is specific to Outlook. Unicode is Unicode. If a tag character survives the trip into Microsoft 365, it survives the trip into Gmail, Yahoo Mail, Proton Mail, and every mobile client rendering the same HTML, which between the big providers covers most of the world's email accounts. Microsoft has the telemetry to notice; smaller providers running simpler rule sets may be getting the same traffic and calling it clean.

The second order risk is the one worth watching. Gmail and Outlook both now put an AI assistant between you and the message: summarize this thread, draft a reply, tell me if this is urgent. Those assistants read the raw text, invisible characters included. A message that looks like a two line note about an invoice can carry a paragraph of instructions your assistant obeys and you never see. That is the exact failure the Gemini research demonstrated, and the tag block is a working delivery mechanism for it that just proved it can move at a scale of millions of messages a day.

For anyone triaging their own inbox, the practical read is narrow but firm. Do not treat a clean spam score as a verdict on a message asking for money, credentials, or urgency, because the thing that gave it a clean score may simply have failed to read it. Filters are still doing most of the work, as the 7.6 billion phishing threats Microsoft blocked in a single quarter makes clear. They are just no longer doing it by reading the words.

What Should Defenders Actually Change?

Microsoft's guidance compresses to four words: normalize before you match. Everything else follows from that.

• Strip U+E0000 to U+E007F before any detection logic runs. Signatures, regexes, keyword lists, classifier input. If normalization happens after matching, or not at all, the rule is decorative.
• Alert on the presence of the characters themselves. Legitimate business mail has essentially no reason to carry tag block code points. Microsoft calls this a strong anomaly signal, and unlike keyword matching it cannot be split in half.
• Extend the same normalization to zero width joiners, non joiners, and bidirectional controls. The tag block is the current favorite, not the only option, and the Unicode Consortium's security considerations report (UTR 36) catalogs the rest.
• Check what your AI assistant is fed. Any summarization or agent pipeline touching untrusted email should receive normalized text, not the raw body.
• Keep the boring controls weighted heavily. Sender reputation, authentication, and URL analysis are what caught this. That lesson repeats in the SVG voicemail campaign that beat content filters and got stopped by DMARC.

The comforting number here is the 99% catch rate. The uncomfortable one is why: reputation and authentication held, and the content layer was blind for three months without anyone noticing until a hunt written for an entirely different threat tripped over it.