Scammers are hiding invisible characters inside phishing emails to slip past the filters

Security researchers at Microsoft have documented a phishing campaign that hides its bait inside email text using characters no reader will ever see. The technique wedges an invisible Unicode symbol into ordinary words like “funding” and “loan,” breaking up the exact strings that automated spam filters are trained to catch while leaving the word looking completely normal to a human eye. The company published its findings on September 3, 2026, describing a campaign that at its peak sent millions of messages a day.

How the invisible character trick works

The method relies on a block of Unicode code points originally designed for tagging text with metadata, running from U+E0000 to U+E007F. These characters render as nothing at all in virtually every email client, but they still count as characters to a computer parsing the message. Attackers insert one of these invisible symbols in the middle of a keyword, so “funding” becomes “fun” plus a hidden character plus “ding.”

Microsoft’s security blog describes the approach as a direct repurposing of “ASCII smuggling,” a technique first documented as a way to sneak hidden instructions past artificial intelligence systems that read text input. Applied to email, the same trick defeats a word-list filter that is scanning for an exact match, because the string the filter is looking for technically no longer exists in the message. The Tags block itself was originally set aside by the Unicode standard for language-tagging purposes that were later deprecated, which is part of why so many parsing systems, including spam filters, never built in a check for it: the characters were expected to be rare, not weaponized.

That gap between what a filter reads and what a person sees is not unique to this one campaign, but the scale at which it was exploited here is unusual. Because the hidden character sits inside the word rather than around it, simple filtering rules that strip leading or trailing whitespace, or that scan for suspicious characters only at the start of a message, would not have caught it either. The insertion point matters as much as the character itself.

Millions of messages built around loan and funding pitches

The lure content itself was mundane by design. Messages leaned on words such as funding, capital, loan, advance and credit, pitching business funding offers, loans and credit services aimed at small business owners and other recipients likely to open a message about money. Volume peaked at up to 2.37 million messages in a single day in late February, according to BleepingComputer’s report on the Microsoft research. That kind of volume, sustained for weeks, is the signature of an automated sending operation rather than a handful of individual scammers working by hand. The sending pattern also followed a distinctly business-like rhythm, concentrated heavily on weekdays and largely absent on weekends, a scheduling detail that further suggested an organized operation running on something close to office hours rather than a diffuse, round-the-clock botnet.

A small cluster of domains drove nearly all of it

Despite the scale, the campaign was not spread evenly across the internet. On February 9, Microsoft’s detection team identified 148 finance-themed sender domains that together accounted for roughly 96 percent of the messages its new Unicode-tag hunting logic flagged. That concentration suggests a small number of operators, or a shared toolkit passed between a small number of operators, rather than a broad grassroots wave of copycat scams. Domain names built around financial services terminology helped the messages blend in with legitimate small-business lending outreach, adding a second layer of camouflage on top of the hidden characters themselves. That combination, a narrow set of coordinated domains paired with a single evasion technique applied consistently across all of them, is what allowed Microsoft’s detection team to isolate the campaign once it started specifically hunting for the Unicode-tag pattern rather than trying to catch each new domain individually.

From an AI research curiosity to a live email threat

ASCII smuggling first drew attention among researchers studying how large language models process text, where hidden Unicode characters could be used to slip instructions past a model’s visible context without a human reviewer noticing anything unusual in a document or webpage. The Hacker News noted that the crossover from that research setting into live spam infrastructure marks one of the first documented cases of the technique being weaponized at scale outside the AI safety field it originated in. Microsoft researchers Noam Kochavi and Sarah Wolstencroft, who authored the disclosure, framed the campaign as evidence that filter-evasion techniques developed for one purpose tend to migrate quickly into whichever system is easiest to exploit next.

Why keyword-based filters missed the flood

Most email security systems still lean heavily on keyword and pattern matching as one layer of a broader detection stack, alongside sender reputation, volume anomalies and link analysis. Those keyword layers assume that the word a scammer wants a recipient to read is the same string of characters a filter needs to match against. Inserting an invisible character breaks that assumption without breaking the message’s meaning for a human reader, since email rendering engines simply skip over non-printing code points. The mismatch let a large share of the campaign’s messages reach inboxes even at organizations running otherwise capable spam defenses, until Microsoft’s team specifically built detection logic aimed at the Tags block itself.

What comes next for filtering systems

Microsoft’s researchers recommended that email security tools strip or normalize invisible Unicode code points before running keyword, signature or regular-expression checks, closing the specific gap this campaign exploited. Volumes tied to the campaign fell sharply after its February and March peak once the technique drew scrutiny, though Microsoft’s disclosure indicates related activity continued at a reduced level into the following months. The broader lesson researchers drew is less about this one campaign than about the category of trick it represents: any system that parses text for meaning while also allowing invisible characters through unchanged creates a gap between what a filter reads and what a person sees, and that gap is exactly what this campaign was built to exploit. Security teams outside Microsoft have since begun auditing their own filtering pipelines for the same blind spot, treating the disclosure as a prompt to check whether keyword-based detection anywhere in a mail system assumes that the text it scans matches the text a reader ultimately views on screen.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview