A large-scale ASCII smuggling phishing campaign has been using invisible Unicode characters to slip finance-themed lures past email security filters, with Microsoft tracking daily message volumes that peaked at up to 2.37 million in late February 2026. The technique is an old one in AI prompt-injection circles, but its appearance in bulk email at this scale is a different proposition entirely.
The trick draws on Unicode characters from the Tags block (U+E0000 to U+E007F), a range that renders as invisible in most email clients. By inserting one of these characters inside a finance keyword, an attacker can cause a word like ‘funding’ to register as ‘fun[invisible character]ding’ in the filter’s eyes, breaking any match against a word list or regex pattern while leaving the word visually intact for the recipient. Microsoft describes the method as working as intended against filters that rely solely on keyword matching.
How the ASCII Smuggling Phishing Campaign Was Built
Microsoft identified the core infrastructure of the operation on 9 February 2026, flagging a cluster of 148 finance-themed sender domains that accounted for about 96% of all messages its updated Defender for Office 365 hunting logic caught with Unicode-tag signatures. The domains leaned heavily on words such as ‘funding’, ‘capital’, ‘loan’, ‘advance’, and ‘credit’, and the messages themselves promoted business funding, loans, and credit services.
The timing of the technique’s adoption was sharp. According to SC Media, Microsoft observed the frequency of Unicode Tags block usage in emails jump from roughly 5,000-20,000 messages per day to more than 1.3 million on 9 February 2026 alone, the day the cluster was identified. That is not a gradual escalation; someone flipped a switch.
Delivery ran through infrastructure associated with ActiveCampaign, a legitimate email-marketing platform. After receiving Microsoft’s report of abuse, ActiveCampaign stated that its moderation systems detect invisible Unicode characters in the same way they detect unobfuscated text, and treat heavy use of such characters as suspicious.
Ties to a Broader, Longer-Running Operation
The campaign does not appear to be an isolated experiment. SC Media reports that researchers were able to connect it to a known, ongoing financial lure-themed phishing operation that Fortra had previously identified in September 2025. The Unicode smuggling technique, in other words, was a later addition to a campaign that predates it.
Microsoft’s own telemetry supports that framing. ‘The high-volume phase persisted for roughly three months after February 9 and dropped sharply after May 15, 2026,’ the company explained. ‘These dates bound the observed use of the specific technique in our telemetry, not the broader campaign, which started earlier without it and continued without it.’
The broader picture is wider still. The Hacker News reports the campaign is assessed to be tied to an operation that weaponised the ActiveCampaign platform to distribute thousands of AI-generated phishing emails targeting Small Business Administration (SBA) loan applicants, a detail that sharpens the picture of who the intended victims are and why finance terminology featured so prominently in the lure domains.
What Defenders Should Do
Microsoft’s guidance is practical. It recommends stripping or normalising Unicode tag characters and other invisible code points before applying keyword, regex, or signature-based detection, rather than relying on those methods alone. Unexpected characters from the Tags block should be treated as a strong anomaly signal in their own right, regardless of whether surrounding content looks benign.
The same normalisation step applies when passing email content to AI assistants. ASCII smuggling was originally documented as a way to embed malicious instructions in text that a language model would process but a human would not see, so email content piped into an AI assistant without pre-processing carries a secondary prompt-injection risk on top of the phishing lure itself.
Despite the technique’s effectiveness against keyword filters, Microsoft’s Defender still caught over 99% of the campaign’s messages by relying on other signals: sender reputation, IP address, domain checks, and related indicators. The volume, however, has only dropped gradually since May, and Microsoft notes the operation remains active, meaning defenders who have not yet updated their normalisation pipelines are still running behind the threat.
