Million-dollar phishing campaign uses invisible Unicode characters to bypass email filters

Microsoft has reported a high-volume phishing campaign that inserts invisible Unicode characters into lure keywords. The goal is to break up the strings searched for by antispam systems without changing what recipients see on screen.

The operation emerged in early February 2026 and peaked on February 26, 2026. On weekdays, volumes were estimated at between 1 million and 2.37 million messages a day. After roughly three months of intense activity, traffic dropped sharply after May 15, 2026.

This is not a traditional software vulnerability. There are no associated CVEs, CVSS scores, vulnerable versions, or updates to install. Instead, the campaign exploits differences in how interfaces, parsers, and security tools process Unicode text.

Words that look normal to people but fragmented to filters

The technique is described as a form of ASCII smuggling. The operators insert Unicode code points that many interfaces do not display, creating a mismatch between the visible representation and the content actually analyzed.

The abused block is Unicode Tags, which spans U+E0000 to U+E007F. It contains “shadow” equivalents for various ASCII characters: U+E0041, for example, corresponds to the uppercase letter “A,” while U+E0061 represents the lowercase “a.” The block was designed for language tagging and is now largely deprecated.

In this campaign, these characters are inserted into words related to loans and financing. A string such as funding can be constructed conceptually as:

fun<U+E0020>ding

The code point inserted between the two portions may remain invisible in the email interface. The recipient therefore continues to read “funding,” while a rule looking for the contiguous ASCII sequence may fail to detect it.

The issue primarily affects checks based on literal matches or regular expressions that do not account for non-rendered characters. At the code-point level, the word is no longer a continuous sequence. The underlying encoding also contains additional data between the expected letters.

Not all systems handle these characters the same way. Some remove or ignore tags during rendering; others preserve the entire sequence. This inconsistency allows attackers to display apparently normal text while altering the input received by detection engines.

Millions of emails sent on a normal business schedule

The campaign’s activity shows a pronounced weekly pattern. Sending was heavy on weekdays, nearly stopped over the weekend, and resumed on Monday.

Volumes ranged from 1 million to 2.37 million messages per day, with the peak recorded on February 26, 2026. The scale sets this operation apart from earlier experimental attempts involving invisible characters, homoglyphs, or other forms of Unicode manipulation.

The lures imitated offers for:

• business loans;
• lines of credit;
• advance funding.

The potential impact extends beyond a recipient clicking a single fraudulent email. Pages reached through these messages can be used to collect credentials, business information, and financial data. These details can then support more precise spear-phishing campaigns.

The presence of financial terms split with Unicode also reduces the effectiveness of static rules. A filter that searches only for words such as “funding,” “loan,” or “credit” in their ASCII form may fail to recognize visually identical variants.

ActiveCampaign used as forwarding infrastructure

The messages were routed through ActiveCampaign, a legitimate marketing and automation platform. Links in the emails also passed through domains used by the service for click tracking:

• acemlnd[.]com
• activehosted[.]com

Using a well-known provider gives attackers a reputational advantage. Traffic may originate from infrastructure with established authentication and IP reputation, making it resemble a normal commercial campaign.

This does not make every message or link associated with ActiveCampaign domains malicious. These are shared services used by legitimate customers as well. Indicators should therefore be correlated with the email content, destination domains, the age of sending domains, and the anomalous presence of Unicode characters.

ActiveCampaign said it had tested its moderation systems using messages containing invisible characters. According to the company, obfuscated versions receive the same verdict as their unmodified counterparts, while extensive use of these code points is also treated as suspicious.

The campaign used hundreds of disposable sender domains with names related to credit and finance. The domains recording the highest number of visits included:

guardiangrowthfunding[.]com
digitalcapitalboost[.]com
thebusinessloanexpress[.]com
yourlocfunding[.]com
advancefundingboost[.]com
guardiancapitalway[.]com
harboradvancefunding[.]com
unitedfundingwave[.]com
directcapitalboost[.]com
onlinedirectfinance[.]com

These domains can be used as threat-hunting indicators, but should not be treated in isolation as sufficient signatures for blocking every associated message.

The link to phishing targeting SBA loan applicants

Microsoft believes the activity is connected to a broader campaign that had already abused ActiveCampaign to send thousands of AI-generated emails. The targets were applicants for Small Business Administration (SBA) loans.

Details of that operation were made public by the Fortra Intelligence and Research Experts (FIRE) team in September 2025. The apparent goal was to collect detailed information about victims’ businesses and financial circumstances, likely in preparation for more personalized follow-on attacks.

One characteristic of the operation was the large-scale production of credible websites tailored to different domains, including illegitimate addresses or domains designed to impersonate other organizations. AI-based marketing automation features allowed the operators to quickly change page copy, graphics, and user flows.

The use of artificial intelligence therefore does not replace the traditional phishing infrastructure. It makes that infrastructure faster to modify and easier to replicate across numerous domains.

What security teams should look for

Because there is no patch, mitigation must focus on the email-analysis pipeline. Gateways should not limit themselves to searching for contiguous ASCII keywords; they should also inspect the original Unicode sequence.

An effective control can maintain two parallel representations:

1. the raw content, preserved for forensic analysis and detection of suspicious code points;
2. a transformed copy used for classification, in which characters from the U+E0000–U+E007F block are removed or flagged.

The transformation should not delete evidence before it is logged. Comparing the original and sanitized text can itself become a detection signal: if a financial term appears only after the tags are removed, the message warrants additional review.

SOC teams can look for combinations of:

• code points in the U+E0000–U+E007F range;
• financial terms interrupted by non-rendered characters;
• recent or disposable sender domains;
• unsolicited offers for loans and lines of credit;
• redirects through acemlnd[.]com or activehosted[.]com;
• final destinations that differ from the displayed domain;
• forms requesting credentials or business financial information.

AI systems based on language models also require caution. Invisible content collected from emails, documents, or web pages may be interpreted differently by components that render it. This can also create potential prompt-injection scenarios when external data is automatically inserted into an AI assistant’s context.

In this case, defense starts with consistency: content shown to the user, analyzed by the filter, and passed to any AI models should be subject to the same canonicalization and validation rules. Otherwise, a space that nobody can see may be enough to separate a word from the detector looking for it.