Threat reportPhishingTL-2026-2338
ASCII Smuggling Phishing Campaign Uses Invisible Unicode Tags-Block Characters to Evade Filters, Targeting Millions of SBA Loan Applicants
ASCII Smuggling Phishing Campaign Uses Invisible Unicode (TL-2026-2338), also tracked as ASCII Smuggling Phishing Campaign, is a high-severity phishing campaign, first published 2026-09-05 and last reviewed 2026-09-06. It has no confirmed attribution, affects ActiveCampaign Email-marketing / click-tracking SaaS platform, maps to 11 MITRE ATT&CK techniques (T1027, T1036, T1056), and is covered by 9 detection rules and 20 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 11MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-2338
- Threat ID
- TL-2026-2338
- Also known as
- ASCII Smuggling Phishing Campaign, ActiveCampaign SBA Loan Phishing Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- small business, financial services
- Target regions
- united states of america
- Detection rules
- 9
- Indicators of compromise
- 20
- Updates
- 2026-09-06 · revalidated 1× · latest source
Malware and tooling in ASCII Smuggling Phishing Campaign Uses Invisible Unicode
Malware and tooling: ASCII Smuggler Tool (Embrace The Red)
How ASCII Smuggling Phishing Campaign Uses Invisible Unicode works
A high-volume phishing operation embeds invisible Unicode Tags-block characters (U+E0000-U+E007F, e.g. TAG SPACE U+E0020) inside financial lure words such as "funding" to defeat keyword-based email filters, sending up to 2.37 million messages on peak weekdays between February 9 and May 15, 2026 to Small Business Administration (SBA) loan applicants. The campaign relays traffic through the legitimate ActiveCampaign email-marketing platform (acemlnd[.]com, activehosted[.]com click-tracking) and harvests business/financial data to fuel future spear-phishing, extending an ActiveCampaign-abuse operation Fortra's FIRE team first disclosed in September 2025.
Microsoft Security Research documented a repurposing of "ASCII smuggling" — a technique that gained prominence in 2025 AI prompt-injection and cross-prompt-injection (XPIA) research (popularized by tools such as Embrace The Red's ASCII Smuggler) for hiding instructions inside invisible Unicode Tags-block characters — for traditional email-filter evasion rather than AI manipulation. The Unicode Tags block (U+E0000-U+E007F) is a largely deprecated range originally intended for language tagging that provides a non-rendering "shadow copy" of printable ASCII (e.g. U+E0041 mirrors 'A', U+E0061 mirrors 'a'). Attackers inserted these invisible characters, most notably the TAG SPACE (U+E0020), inside financial keywords — turning "funding" into "fun<U+E0020>ding" — so the word still renders normally to a human recipient while defeating exact-match keyword filters and disrupting tokenization in machine-learning and LLM-based content classifiers.
Microsoft's telemetry shows daily email volume containing this specific Unicode Tags-block usage jumping from a baseline of roughly 5,000-21,000 messages to about 1.3 million on February 9, 2026, climbing to a peak of 2.37 million messages on February 26, 2026, and sustaining a strict Monday-through-Friday cadence (near-zero on weekends) for roughly three months before a sharp decline after May 15, 2026 — a pattern consistent with scheduled, bulk automated delivery.
The campaign is an evolution of an ActiveCampaign-abuse operation Fortra's Intelligence and Research Experts (FIRE) team first disclosed in September 2025: adversaries register disposable, finance-themed lookalike sender domains (Fortra counted roughly 148, built from a shared vocabulary of tokens like "capital," "funding," "loan," "business," "express," "advance," "boost," and "direct") that impersonate SBA-adjacent lending brands, then use the legitimate ActiveCampaign SaaS email-marketing platform — including its acemlnd[.]com and activehosted[.]com click-tracking/redirect infrastructure and an em-<digits>.<brand-domain> envelope pattern — to mass-deliver AI-generated phishing emails and AI-mass-produced landing pages at scale. Roughly 92% of the campaign's sending volume traced to a single /24 network block, 173.236.20.0/24. The lures impersonate SBA "pre-selected new line of credit" loan offers promising $4-10 million in funding within 48 hours, and the landing pages collect detailed applicant data — business/entity name, revenue figures, requested loan amount, credit score, and contact details — that Fortra and Microsoft both assess is intended to enable future, more convincing spear-phishing against the same small businesses rather than immediate financial theft.
Microsoft reports that more than 99% of the ASCII-smuggling-laden messages were still caught by layered Defender protections that did not rely on catching the tag characters directly — sender/IP/URL/domain reputation, authentication checks, ML-based spam/phishing classification, brand-impersonation detection, and OCR-based extraction of visible text from rendered message content — and recommends that defenders normalize (strip or fold) Unicode Tags-block characters before applying keyword signatures or feeding content to AI-based classifiers or assistants, since the same evasion primitive can be repurposed against LLM content pipelines.
MITRE ATT&CK techniques used in TL-2026-2338
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1684.001 Impersonation
Credential Access
Execution
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1588 Obtain Capabilities
Reconnaissance
T1589 Gather Victim Identity Information; T1598 Phishing for Information
Affected products and versions in ASCII Smuggling Phishing Campaign Uses Invisible Unicode
- ActiveCampaign — Email-marketing / click-tracking SaaS platform (acemlnd.com, activehosted.com infrastructure)
Vulnerable versions: N/A - legitimate service abuse, not a software vulnerability
Fixed in: N/A
Remediation for ASCII Smuggling Phishing Campaign Uses Invisible Unicode
Patches
- Not applicable — this is a filter-evasion/social-engineering campaign against a legitimate SaaS mail platform, not a software vulnerability requiring a vendor patch
Immediate actions
- Normalize/strip Unicode Tags-block characters (U+E0000-U+E007F), especially TAG SPACE U+E0020, before applying keyword-based phishing signatures or ML content classification
- Flag or block click-through traffic to acemlnd[.]com and activehosted[.]com where it originates from unsolicited SBA/small-business-loan-themed messages
- Monitor and consider reputation-scoring inbound mail from the 173.236.20.0/24 network block, which carried ~92% of observed campaign volume
- Treat unsolicited SBA-branded 'pre-approved line of credit' emails promising large funding within 48 hours as high-risk lures for user awareness purposes
Workarounds
- Configure mail transfer agents / secure email gateways to fold or strip Unicode Tags-block code points from subject and body text prior to running keyword or ML-based phishing rules
Longer-term hardening
- Deploy layered email defenses that do not depend solely on literal keyword matching: sender/IP/URL/domain reputation, authentication (SPF/DKIM/DMARC) verification, ML-based phishing/spam classification, and brand-impersonation detection
- Extract and analyze visible rendered text (e.g. via OCR of a rendered message) as a fallback signal so invisible-character keyword-splitting cannot fully defeat detection
- Extend the same Unicode-normalization-before-matching principle to any AI assistant or LLM-based pipeline that ingests raw email/web content, since the underlying evasion primitive originated in prompt-injection research
Timeline of ASCII Smuggling Phishing Campaign Uses Invisible Unicode
- Fortra's Intelligence and Research Experts (FIRE) team publicly discloses an AI-generated SBA loan phishing campaign abusing the ActiveCampaign email-marketing platform (acemlnd[.]com / activehosted[.]com click-tracking) to harvest business and financial data from applicants via mass-produced fake lending sites.
- Microsoft observes only a baseline ~5,000-21,000 daily emails containing Unicode Tags-block (U+E0000-U+E007F) characters, prior to the ASCII-smuggling surge.
- Daily volume of phishing emails carrying Unicode Tags-block characters jumps to roughly 1.3 million messages, marking the shift to ASCII-smuggling-based filter evasion at scale.
- A newer report additionally identifies February 11, 2026 as a peak day exceeding 2.3 million messages, alongside the previously recorded February 26 peak of 2.37 million.
- Campaign reaches its peak single-day volume of 2.37 million messages.
- Daily campaign volume steps down roughly 80% below the February peak on weekdays, though the weekday cadence and finance-themed domain infrastructure continue.
- Campaign volume drops sharply, ending roughly three months of sustained high-volume weekday sending (near-zero on weekends).
- Last measured telemetry shows lower residual activity with occasional smaller spikes; the Unicode Tags-block technique is no longer the primary evasion method used.
- Microsoft Security Research publishes 'ASCII smuggling crosses over from AI prompt injection to phishing evasion,' detailing the Unicode Tags-block technique, campaign infrastructure/IOCs, and normalization-based detection guidance.
- The Hacker News and multiple security outlets (SC Media, Security Boulevard, GBHackers) report on Microsoft's findings, bringing the campaign to broader industry attention.
- BleepingComputer and Ars Technica publish additional coverage of the campaign and the ASCII-smuggling technique.
Update history for TL-2026-2338
- 2026-09-06 — Large-Scale Phishing Campaign Uses Invisible Unicode Tags Block Characters (ASCII Smuggling) to Evade Email Security Filters: What changed No field-level escalations: severity, exploitability, status, and attribution confidence are unchanged. The report's own impact rating (MODERATE) is lower than the existing record's (HIGH), but impact is not a whitelisted escal
Sources cited for ASCII Smuggling Phishing Campaign Uses Invisible Unicode
- Phishing Campaign Sends Millions of Emails Using ASCII Smuggling to Evade Detection
- ASCII smuggling crosses over from AI prompt injection to phishing evasion
- Attackers exploit ActiveCampaign to Deliver Thousands of AI-generated SBA Phish
- ASCII smuggling challenges email phishing filters, Microsoft warns
- Microsoft Finds ASCII Smuggling Repurposed for Phishing Campaign
- Fortra Uncovers New, AI-Powered Phishing Campaign Exploiting ActiveCampaign
- Hackers Abuse AI-Era ASCII Smuggling to Hide Phishing Content in Millions of Emails
Detection coverage for TL-2026-2338
As of 2026-09-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2338 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.