Microsoft researchers have uncovered a large-scale phishing campaign that used invisible Unicode characters to bypass spam filters, hiding finance-related keywords from security systems while leaving emails looking normal to recipients.
The campaign was discovered after Microsoft's security team began investigating attacks involving AI prompt injection, a technique designed to manipulate artificial intelligence systems through hidden instructions. Instead, researchers found that attackers were using the same invisible-character method to make traditional phishing emails harder for spam filters to detect.
Microsoft researchers Noam Kochavi and Sarah Wolstencroft noticed unusual activity after developing a detection method to identify the technique. The number of flagged emails surged from about 21,000 messages on Feb. 8 to more than 1.3 million the following day. The attackers used a technique known as "ASCII smuggling," which can hide information inside Unicode characters that are invisible to people but readable by computers and AI systems.
Rather than hiding instructions for an AI model, the attackers inserted invisible characters into ordinary finance-related words such as "funding." The characters broke up the words in ways that could prevent exact keyword-based spam filters from recognizing suspicious content.
The operation used roughly 150 temporary domains linked to finance-themed email activity. Microsoft said the campaign was connected to infrastructure previously identified by cybersecurity company Fortra in September 2025. The attackers also used ActiveCampaign, a legitimate software service, to support their bulk-email operation. Microsoft said the campaign relied on click-tracking domains associated with the service to distribute phishing links.
Despite the campaign's huge volume, Microsoft said its Defender for Office 365 anti-phishing protection detected more than 99% of the malicious emails identified during the investigation. Researchers also found that the campaign followed a clear weekday pattern, with activity dropping sharply during weekends. The pattern suggested the operation was being run according to a structured schedule.
Microsoft recommends that security systems normalize Unicode tag characters before checking messages for suspicious keywords or signatures. These characters fall within the U+E0000 to U+E007F Unicode range. Microsoft also advised security teams to treat unexpected blocks of Unicode tag characters as a potential warning sign.
The discovery highlights how attackers are adapting older evasion techniques for new AI-driven security environments. Systems that rely only on screenshots and optical character recognition, rather than examining a message's underlying text, could overlook the hidden characters entirely.
