Microsoft Warns of Large Phishing Operation Using Hidden Unicode Characters

Microsoft has reported a high-volume phishing campaign that uses invisible Unicode characters to obscure financial terms and reduce the effectiveness of email-filtering rules. The activity, first observed in February 2026, reportedly sent millions of messages on active weekdays before declining significantly after May 15.

The campaign inserts non-rendering characters from the Unicode Tags block into words commonly associated with business financing, loans and funding. Recipients may see an ordinary word, but a security product attempting to match an exact text string may encounter a broken sequence instead. For example, hidden characters placed within a term such as “funding” can prevent a literal keyword or poorly configured regular-expression rule from recognizing it.

Invisible text used as an evasion method

The technique is related to ASCII smuggling, in which non-visible Unicode code points carry or alter text that is not apparent in normal user interfaces. The Unicode Tags range, spanning U+E0000 through U+E007F, includes characters corresponding to printable ASCII symbols and was originally intended for language tagging. It is now largely deprecated.

Microsoft said the operation followed a weekly pattern, with little activity over weekends and message volumes resuming on Mondays. On weekdays, the campaign generated an estimated 1 million to 2.37 million emails, peaking on February 26, 2026.

Finance lures and marketing-platform delivery

The messages used disposable, finance-themed sender domains and imitated business-loan, credit-line and advance-funding offers. Microsoft linked the activity to a broader phishing effort previously associated with abuse of ActiveCampaign, a marketing and automation service. The emails routed links through the platform’s click-tracking infrastructure, which may make malicious traffic appear more like legitimate bulk marketing mail and complicate reputation-based filtering.

Fortra researchers previously described a related campaign targeting Small Business Administration loan applicants and seeking detailed financial and business information that could support later fraud or spear-phishing attempts.

ActiveCampaign said its moderation systems evaluate messages containing invisible Unicode characters similarly to unobfuscated versions, and that extensive use of the technique is treated as suspicious. Microsoft recommended that defenders normalize or remove Unicode tag characters during inspection, detect interleaved invisible code points, and avoid relying solely on exact keyword matching for phishing detection.