# Invisible Unicode Tag Characters Used to Evade Phishing Detection in Financial Scam Campaign > A high-volume, finance-themed phishing campaign inserted invisible Unicode Tag-block characters (U+E0000-U+E007F, including U+E0020 TAG SPACE) inside keywords such as "funding" and "loan" to defeat keyword- and regex-based email filters while rendering normally to recipients. Microsoft Security researchers identified the campaign, termed it "ASCII smuggling" after its origin in AI prompt-injection research, and traced it to roughly 148 rotating finance-themed sender domains relayed through the legitimate ActiveCampaign email-marketing platform at up to 2.3+ million messages/day over roughly three months (Feb-May 2026); Microsoft connected the wave to an earlier, related ActiveCampaign-delivered SBA-loan phishing operation documented by Fortra in September 2025. - **Published:** 2026-09-04T00:00:00Z - **Last reviewed:** 2026-09-04T00:00:00Z - **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2331 - **ID:** TL-2026-2331 - **Severity:** HIGH - **Category:** THREAT_INTEL - **Status:** ACTIVE - **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier) ## Description In February 2026, Microsoft's hunting signature for ASCII-smuggling activity - Unicode text carrying invisible characters from the largely deprecated Unicode Tags block (U+E0000-U+E007F) - jumped from roughly 21,000 hits on February 8 to over 1.3 million messages within 24 hours on February 9, and continued to a sustained daily volume exceeding 2.3 million messages (peaking around February 11, with the single highest weekday volume of ~2.37 million on February 26). The elevated activity persisted for approximately three months with a distinctive weekday-only cadence (sharp weekend drops, resuming Mondays), declining substantially - roughly an 80% reduction from the initial peak by late March, and dropping off further after May 15, 2026. The technique, popularized as "ASCII smuggling" in AI prompt-injection research (invisible Unicode Tag characters used to hide instructions from human reviewers while still being parsed by LLMs; MITRE ATLAS classifies this technique class as AML.T0068, LLM Prompt Obfuscation, and the same character range has separately been used to exfiltrate data from Microsoft Copilot), was repurposed here against traditional email security rather than against an AI system. Operators spliced the invisible TAG SPACE character (U+E0020) and other Tag-block code points into the middle of high-signal financial keywords - for example rendering "funding" while the underlying text carried "funding" - so that literal keyword, signature, and regular-expression checks (and potentially token-based NLP/ML classifiers) failed to recognize the fragmented word, even though the message displayed normally to the recipient. A known benign source of the same code-point range - regional flag emoji (e.g., England/Scotland/Wales), which are built from Unicode Tag sequences - was flagged by Microsoft as a false-positive risk for any blanket tag-block filtering rule. The campaign used approximately 148 disposable, finance-themed sender domains algorithmically built from a rotating vocabulary of roughly 28 business-loan/funding word-tokens (advance, boost, business, capital, catalyst, choice, digital, direct, elevate, express, finance, funding, growth, guardian, harbor, loan, loans, loc, online, our, pulse, rocket, rush, the, united, wave, way, your), including guardiangrowthfunding[.]com, digitalcapitalboost[.]com, thebusinessloanexpress[.]com, harboradvancefunding[.]com, unitedfundingwave[.]com, catalystcapitalharbor[.]com, rocketboostfunding[.]com, yourlocfunding[.]com, advancefundingboost[.]com, guardiancapitalway[.]com, and directcapitalboost[.]com. Lures offered unsolicited business-loan, funding, and credit-line deals with credential/financial-data-harvesting funnel characteristics consistent with the Fortra-documented precursor campaign (which impersonated the U.S. Small Business Administration's pre-selected "new line of credit" programs, promised $4-10M in funding within 48 hours, and used ActiveCampaign's AI-powered marketing automation to mass-produce varied, AI-generated landing pages that harvested detailed business and financial information - assessed as likely intended to fuel future, more targeted spear-phishing). Messages were relayed through the legitimate ActiveCampaign email-marketing platform: roughly 92% of observed volume originated from a single /24 block, 173.236.20.0/24, corresponding to ActiveCampaign's shared sending infrastructure, and ~98.5% of volume matched recognizable ActiveCampaign envelope patterns (~99.8% matched envelope or tracking-URL patterns). Click-through links used ActiveCampaign's own tracking domains (activehosted[.]com, acemlnd[.]com) in a hxxps://.acemlnd[.]com/ URL structure, and envelope (P1) senders followed recognizable shared-pool patterns such as em-., acems[.]com, and emsd[.]com. Microsoft reported that over 99% of the campaign's messages were ultimately caught by layered Defender for Office 365 protections that did not rely solely on the Unicode-tag signature - sender/IP/domain reputation, ML-based spam/phishing classification, brand-impersonation detection, authentication checks, and OCR-based visible-text extraction - meaning direct detection of the invisible characters contributed only marginally to overall catch rate. No CVE, malware family, or named threat actor is associated with this campaign; it is a detection-evasion tradecraft development layered onto an existing bulk-phishing/loan-scam operation (with a documented precursor wave attributed to the same ActiveCampaign-abuse pattern), not a software vulnerability. Microsoft's core recommendation is to normalize email text - stripping or standardizing invisible/non-rendering Unicode characters (while accounting for legitimate uses such as regional flag emoji) - before any keyword, signature, regex, or AI/LLM ingestion pipeline processes it, combined with behavioral fingerprinting for bulk finance-domain activity showing weekend-off cadences. ## MITRE ATT&CK - T1598.003 Phishing for Information: Spearphishing Link - T1583.001 Acquire Infrastructure: Domains - T1583.006 Acquire Infrastructure: Web Services - T1585.002 Establish Accounts: Email Accounts - T1566.002 Phishing: Spearphishing Link - T1204.001 User Execution: Malicious Link - T1027 Obfuscated Files or Information - T1036.005 Match Legitimate Resource Name or Location - T1684.001 Impersonation - T1657 Financial Theft ## Sources - [Hackers Use Invisible Unicode Characters to Evade Phishing Detection in Millions of Emails](https://cybersecuritynews.com/hackers-use-invisible-unicode/) - [ASCII smuggling crosses over from AI prompt injection to phishing evasion](https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/) - [Hackers Abuse AI-Era ASCII Smuggling to Hide Phishing Content in Emails](https://gbhackers.com/ai-era-ascii-smuggling/) - [What is Unicode Tag Smuggling?](https://securelayer7.net/learn/ai-security/unicode-tag-smuggling) - ['ASCII Smuggling' attack exposes sensitive Microsoft Copilot data](https://www.scworld.com/news/ascii-smuggling-attack-exposes-sensitive-microsoft-copilot-data) - [Microsoft Threat Intelligence - ASCII smuggling phishing campaign announcement](https://x.com/MsftSecIntel/status/2095549879049224358) - [LLM Prompt Obfuscation (AML.T0068) - MITRE ATLAS](https://www.startupdefense.io/mitre-atlas-techniques/aml-t0068-llm-prompt-obfuscation-5ac63) - [ASCII smuggling crosses over from AI prompt injection to phishing evasion (mirror)](https://radar.offseq.com/threat/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion-1209b5ad1c3d909d) - [Attackers exploit ActiveCampaign to deliver thousands of AI-generated SBA phish](https://www.fortra.com/blog/attackers-exploit-activecampaign-deliver-thousands-ai-generated-sba-phish) ## Full data Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp Canonical: https://intel.threadlinqs.com/threat/TL-2026-2331