Attackers are using invisible Unicode characters to make phishing lures harder for email filters to read, according to BleepingComputer, citing Microsoft threat researchers. The technique, known as ASCII smuggling, uses Unicode characters from the Tags block, U+E0000 through U+E007F, to encode content that users may not see. BleepingComputer notes that the same technique has previously appeared in AI prompt-injection attacks, where hidden instructions can be concealed from a user while still being interpreted by a system. In the phishing campaign Microsoft described, attackers inserted invisible characters inside finance-related words. A term such as “funding” could be split by a hidden character, making the visible lure look effectively unchanged to the recipient while interfering with filters that depend on matching suspicious words, regular expressions, or signatures. Microsoft found the technique in a large-scale finance-themed campaign that peaked at up to 2.37 million daily messages in late February, BleepingComputer reports. Microsoft said the high-volume phase tied to the Unicode-tag technique lasted for roughly three months after February 9 and dropped sharply after May 15, 2026. The company also said those dates refer to use of the specific technique in its telemetry, not the entire broader campaign, which began earlier without it and continued afterward without it. On February 9, Microsoft identified 148 finance-themed sender domains powering the operation, according to the report. Those domains accounted for about 96% of messages that Microsoft’s new Defender for Office 365 hunting logic flagged for Unicode-tag signatures. The sender domains used words including “funding,” “capital,” “loan,” “advance,” and “credit,” while the messages promoted business funding, loans, and credit services. The campaign did not depend only on the obfuscated keywords. BleepingComputer reports that Microsoft said Defender still caught more than 99% of the messages using other signals, including sender, IP address, domain, and reputation checks. That detail matters: the technique appears designed to bypass one class of content inspection, not to defeat the whole defensive stack by itself. The messages were delivered through infrastructure associated with the legitimate ActiveCampaign email-marketing platform, according to BleepingComputer. After Microsoft reported service abuse, ActiveCampaign said its moderation systems detect invisible Unicode characters in the same way they detect unobfuscated text and treat heavy use of such characters as suspicious. Microsoft’s recommended fix is straightforward but easy to miss in older detection pipelines: strip or normalize Unicode tag characters and other invisible code points before applying keyword lists, regular expressions, or signature-based rules. Microsoft also recommends treating unexpected tag-block characters as a strong anomaly. The same normalization step can apply beyond email security. BleepingComputer reports Microsoft’s view that normalizing content before sending it to AI assistants should help reduce prompt-injection risk from hidden instructions encoded with invisible characters. Who benefits: Attackers benefit when defenses rely heavily on keyword matching without normalizing hidden characters first. Defenders benefit from layered detection, since Microsoft said other signals still caught more than 99% of the observed messages. Who's exposed: Organizations using keyword-, regex-, or signature-heavy mail filtering without Unicode normalization are more exposed to this specific evasion. Teams routing email content into AI assistants also face risk if hidden characters are not stripped before processing.