Threat reportThreat IntelligenceTL-2026-2331
Invisible Unicode Tag Characters Used to Evade Phishing Detection in Financial Scam Campaign
Invisible Unicode Tag Characters Used to Evade Phishing (TL-2026-2331), also tracked as ASCII Smuggling Phishing Campaign, is a high-severity tracked intrusion set, first published 2026-09-04. It has no confirmed attribution, affects Multiple (industry-wide) Email security gateways and phishing filters, maps to 10 MITRE ATT&CK techniques (T1027, T1036.005, T1204.001), and is covered by 9 detection rules and 19 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 10MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 19Indicators of compromise
Key facts for TL-2026-2331
- Threat ID
- TL-2026-2331
- Also known as
- ASCII Smuggling Phishing Campaign, Invisible Unicode Tag Character Phishing Evasion
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- general business email users, small and mid-size business owners, financial services brand impersonation
- Detection rules
- 9
- Indicators of compromise
- 19
How Invisible Unicode Tag Characters Used to Evade Phishing works
A high-volume, finance-themed phishing campaign inserted invisible Unicode Tag-block characters (U+E0000-U+E007F, including U+E0020 TAG SPACE) inside keywords such as "funding" and "loan" to defeat keyword- and regex-based email filters while rendering normally to recipients. Microsoft Security researchers identified the campaign, termed it "ASCII smuggling" after its origin in AI prompt-injection research, and traced it to roughly 148 rotating finance-themed sender domains relayed through the legitimate ActiveCampaign email-marketing platform at up to 2.3+ million messages/day over roughly three months (Feb-May 2026); Microsoft connected the wave to an earlier, related ActiveCampaign-delivered SBA-loan phishing operation documented by Fortra in September 2025.
In February 2026, Microsoft's hunting signature for ASCII-smuggling activity - Unicode text carrying invisible characters from the largely deprecated Unicode Tags block (U+E0000-U+E007F) - jumped from roughly 21,000 hits on February 8 to over 1.3 million messages within 24 hours on February 9, and continued to a sustained daily volume exceeding 2.3 million messages (peaking around February 11, with the single highest weekday volume of ~2.37 million on February 26). The elevated activity persisted for approximately three months with a distinctive weekday-only cadence (sharp weekend drops, resuming Mondays), declining substantially - roughly an 80% reduction from the initial peak by late March, and dropping off further after May 15, 2026.
The technique, popularized as "ASCII smuggling" in AI prompt-injection research (invisible Unicode Tag characters used to hide instructions from human reviewers while still being parsed by LLMs; MITRE ATLAS classifies this technique class as AML.T0068, LLM Prompt Obfuscation, and the same character range has separately been used to exfiltrate data from Microsoft Copilot), was repurposed here against traditional email security rather than against an AI system. Operators spliced the invisible TAG SPACE character (U+E0020) and other Tag-block code points into the middle of high-signal financial keywords - for example rendering "funding" while the underlying text carried "fun<U+E0020>ding" - so that literal keyword, signature, and regular-expression checks (and potentially token-based NLP/ML classifiers) failed to recognize the fragmented word, even though the message displayed normally to the recipient. A known benign source of the same code-point range - regional flag emoji (e.g., England/Scotland/Wales), which are built from Unicode Tag sequences - was flagged by Microsoft as a false-positive risk for any blanket tag-block filtering rule.
The campaign used approximately 148 disposable, finance-themed sender domains algorithmically built from a rotating vocabulary of roughly 28 business-loan/funding word-tokens (advance, boost, business, capital, catalyst, choice, digital, direct, elevate, express, finance, funding, growth, guardian, harbor, loan, loans, loc, online, our, pulse, rocket, rush, the, united, wave, way, your), including guardiangrowthfunding[.]com, digitalcapitalboost[.]com, thebusinessloanexpress[.]com, harboradvancefunding[.]com, unitedfundingwave[.]com, catalystcapitalharbor[.]com, rocketboostfunding[.]com, yourlocfunding[.]com, advancefundingboost[.]com, guardiancapitalway[.]com, and directcapitalboost[.]com. Lures offered unsolicited business-loan, funding, and credit-line deals with credential/financial-data-harvesting funnel characteristics consistent with the Fortra-documented precursor campaign (which impersonated the U.S. Small Business Administration's pre-selected "new line of credit" programs, promised $4-10M in funding within 48 hours, and used ActiveCampaign's AI-powered marketing automation to mass-produce varied, AI-generated landing pages that harvested detailed business and financial information - assessed as likely intended to fuel future, more targeted spear-phishing).
Messages were relayed through the legitimate ActiveCampaign email-marketing platform: roughly 92% of observed volume originated from a single /24 block, 173.236.20.0/24, corresponding to ActiveCampaign's shared sending infrastructure, and ~98.5% of volume matched recognizable ActiveCampaign envelope patterns (~99.8% matched envelope or tracking-URL patterns). Click-through links used ActiveCampaign's own tracking domains (activehosted[.]com, acemlnd[.]com) in a hxxps://<account-id>.acemlnd[.]com/<tracking-token> URL structure, and envelope (P1) senders followed recognizable shared-pool patterns such as em-<digits>.<brand-domain>, acems<N>[.]com, and emsd<N>[.]com.
Microsoft reported that over 99% of the campaign's messages were ultimately caught by layered Defender for Office 365 protections that did not rely solely on the Unicode-tag signature - sender/IP/domain reputation, ML-based spam/phishing classification, brand-impersonation detection, authentication checks, and OCR-based visible-text extraction - meaning direct detection of the invisible characters contributed only marginally to overall catch rate. No CVE, malware family, or named threat actor is associated with this campaign; it is a detection-evasion tradecraft development layered onto an existing bulk-phishing/loan-scam operation (with a documented precursor wave attributed to the same ActiveCampaign-abuse pattern), not a software vulnerability. Microsoft's core recommendation is to normalize email text - stripping or standardizing invisible/non-rendering Unicode characters (while accounting for legitimate uses such as regional flag emoji) - before any keyword, signature, regex, or AI/LLM ingestion pipeline processes it, combined with behavioral fingerprinting for bulk finance-domain activity showing weekend-off cadences.
MITRE ATT&CK techniques used in TL-2026-2331
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1684.001 Impersonation
Execution
T1204.001 User Execution: Malicious Link
Initial Access
T1566.002 Phishing: Spearphishing Link
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1583.006 Acquire Infrastructure: Web Services; T1585.002 Establish Accounts: Email Accounts
Reconnaissance
T1598.003 Phishing for Information: Spearphishing Link
Impact
Affected products and versions in Invisible Unicode Tag Characters Used to Evade Phishing
- Multiple (industry-wide) — Email security gateways and phishing filters using literal keyword, signature, or regular-expression content matching
Vulnerable versions: Filtering logic that tokenizes/matches on raw or naively-normalized message text without stripping invisible Unicode Tags-block characters
Fixed in: Filtering pipelines that normalize/strip Unicode Tags-block (U+E0000-U+E007F) and other non-rendering characters prior to keyword, signature, regex, or ML/NLP classification - Microsoft — Microsoft Defender for Office 365
Fixed in: Layered detection (reputation, ML classification, brand-impersonation detection, authentication checks, OCR-based visible-text extraction) reported to catch over 99% of campaign messages independent of direct Unicode-tag signature matching
Remediation for Invisible Unicode Tag Characters Used to Evade Phishing
Immediate actions
- Normalize email subject and body text - strip or standardize characters in the Unicode Tags block (U+E0000-U+E007F) and other invisible/zero-width code points - before applying keyword, signature, or regular-expression checks in mail filters and SOAR playbooks
- Treat the presence of unexpected hidden/non-rendering characters (especially mid-word) as an anomaly signal worth investigating, while excluding known-legitimate uses such as regional flag emoji sequences that also use Tag-block code points
- Hunt for and block the disclosed finance-themed sender domains and ActiveCampaign click-tracking infrastructure (activehosted[.]com, acemlnd[.]com) associated with this specific campaign wave, and expand blocking to the broader domain-vocabulary pattern (the ~28-token recombination scheme) to catch un-disclosed rotations
- Do not rely on a single detection signal - combine sender/IP/domain reputation, authentication (SPF/DKIM/DMARC), URL/click-time analysis, ML/NLP classification, brand-impersonation detection, and visual/OCR analysis of rendered content
Workarounds
- Configure mail transport rules to reject or quarantine messages containing Unicode Tags block characters (U+E0000-U+E007F) outside of known legitimate emoji-flag sequences
- Educate finance/lending-adjacent staff to treat unsolicited business-loan, funding, or credit-line offers - especially any purporting to be pre-selected SBA or government-backed financing - as high-risk regardless of apparent sender legitimacy
Longer-term hardening
- Apply the same text-normalization step upstream of any AI/LLM ingestion pipeline (ticketing, RAG, copilots) that processes external email content, since the same invisible-character technique is directly usable for prompt injection against those systems
- Test email gateways, security analytics pipelines, and AI systems for consistent handling of hidden/invisible Unicode characters as part of regular security control validation
- Monitor for abrupt spikes in mail volume tied to new finance-themed sender domains and weekday-only bulk-send cadences, which are stronger behavioral indicators than the raw presence of invisible characters
- Engage SaaS email-marketing providers (ActiveCampaign and peers) on abuse-reporting SLAs and shared-infrastructure reputation isolation, given the recurring pattern of this platform being abused for both this campaign and the earlier Fortra-documented SBA-themed wave
Timeline of Invisible Unicode Tag Characters Used to Evade Phishing
- Fortra's FIRE team publishes documentation of an earlier, related ActiveCampaign-delivered phishing operation impersonating U.S. Small Business Administration (SBA) pre-selected loan programs, using AI-generated websites promising $4-10M in funding to harvest detailed business/financial data; Microsoft later connects the 2026 ASCII-smuggling wave to this precursor activity.
- Microsoft's ASCII-smuggling hunting signature registers a baseline ~21,000 hits, the last quiet day before the campaign's onset.
- Sharp onset: hits on the hunting signature jump to over 1.3 million messages within 24 hours, marking the start of the high-volume phase; sustained weekday-on/weekend-off cadence begins across roughly 148 rotating finance-themed sender domains relayed through ActiveCampaign.
- Microsoft observes an early peak day of roughly 2.3 million messages carrying invisible Unicode Tag-block characters in finance-themed lures.
- Campaign reaches its highest single-day weekday volume, approximately 2.37 million messages.
- Volume has fallen roughly 80% from the initial peak by late March, though the campaign continues at reduced, still-elevated weekday volumes.
- Campaign volume declines substantially after this date, ending the high-volume phase observed by Microsoft telemetry.
- Microsoft Security publishes "ASCII smuggling crosses over from AI prompt injection to phishing evasion," detailing the campaign, its infrastructure, its link to the Fortra-documented SBA-themed precursor, and detection/normalization guidance.
- Cyber Security News and other outlets report on Microsoft's findings; the Cyber Security News article is ingested as the hunt source for this threat record.
Sources cited for Invisible Unicode Tag Characters Used to Evade Phishing
- Hackers Use Invisible Unicode Characters to Evade Phishing Detection in Millions of Emails
- ASCII smuggling crosses over from AI prompt injection to phishing evasion
- Hackers Abuse AI-Era ASCII Smuggling to Hide Phishing Content in Emails
- What is Unicode Tag Smuggling?
- 'ASCII Smuggling' attack exposes sensitive Microsoft Copilot data
- Microsoft Threat Intelligence - ASCII smuggling phishing campaign announcement
- LLM Prompt Obfuscation (AML.T0068) - MITRE ATLAS
- ASCII smuggling crosses over from AI prompt injection to phishing evasion (mirror)
- Attackers exploit ActiveCampaign to deliver thousands of AI-generated SBA phish
Detection coverage for TL-2026-2331
As of 2026-09-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2331 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.