Microsoft warns of phishing campaign using invisible Unicode to bypass email filters

Microsoft has detailed a high-volume phishing campaign that uses invisible Unicode tag characters to evade email filters. The technique, called ASCII smuggling, splits financial lure words such as ‘funding’ so that they appear normal to recipients but do not match keyword-based detection.

The campaign ran from early February 2026, peaking at 2.37 million messages on 26 February, before dropping sharply after 15 May. It is linked to a broader operation that abused the ActiveCampaign marketing platform to target Small Business Administration loan applicants.

Microsoft said the abuse of the Unicode Tags block is novel at this scale, and that the use of a reputable marketing platform complicates reputation-based filtering. ActiveCampaign said its content moderation systems treat such messages as equivalent to unobfuscated ones and flag heavy use as suspicious.