# ASCII Smuggling Phishing Campaign Uses Invisible Unicode Tags-Block Characters to Evade Filters, Targeting Millions of SBA Loan Applicants > A high-volume phishing operation embeds invisible Unicode Tags-block characters (U+E0000-U+E007F, e.g. TAG SPACE U+E0020) inside financial lure words such as "funding" to defeat keyword-based email filters, sending up to 2.37 million messages on peak weekdays between February 9 and May 15, 2026 to Small Business Administration (SBA) loan applicants. The campaign relays traffic through the legitimate ActiveCampaign email-marketing platform (acemlnd[.]com, activehosted[.]com click-tracking) and harvests business/financial data to fuel future spear-phishing, extending an ActiveCampaign-abuse operation Fortra's FIRE team first disclosed in September 2025. - **Published:** 2026-09-05T00:00:00Z - **Last reviewed:** 2026-09-06T15:13:16.419Z - **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2338 - **ID:** TL-2026-2338 - **Severity:** HIGH - **Category:** PHISHING - **Status:** ACTIVE - **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier) ## Description Microsoft Security Research documented a repurposing of "ASCII smuggling" — a technique that gained prominence in 2025 AI prompt-injection and cross-prompt-injection (XPIA) research (popularized by tools such as Embrace The Red's ASCII Smuggler) for hiding instructions inside invisible Unicode Tags-block characters — for traditional email-filter evasion rather than AI manipulation. The Unicode Tags block (U+E0000-U+E007F) is a largely deprecated range originally intended for language tagging that provides a non-rendering "shadow copy" of printable ASCII (e.g. U+E0041 mirrors 'A', U+E0061 mirrors 'a'). Attackers inserted these invisible characters, most notably the TAG SPACE (U+E0020), inside financial keywords — turning "funding" into "funding" — so the word still renders normally to a human recipient while defeating exact-match keyword filters and disrupting tokenization in machine-learning and LLM-based content classifiers. Microsoft's telemetry shows daily email volume containing this specific Unicode Tags-block usage jumping from a baseline of roughly 5,000-21,000 messages to about 1.3 million on February 9, 2026, climbing to a peak of 2.37 million messages on February 26, 2026, and sustaining a strict Monday-through-Friday cadence (near-zero on weekends) for roughly three months before a sharp decline after May 15, 2026 — a pattern consistent with scheduled, bulk automated delivery. The campaign is an evolution of an ActiveCampaign-abuse operation Fortra's Intelligence and Research Experts (FIRE) team first disclosed in September 2025: adversaries register disposable, finance-themed lookalike sender domains (Fortra counted roughly 148, built from a shared vocabulary of tokens like "capital," "funding," "loan," "business," "express," "advance," "boost," and "direct") that impersonate SBA-adjacent lending brands, then use the legitimate ActiveCampaign SaaS email-marketing platform — including its acemlnd[.]com and activehosted[.]com click-tracking/redirect infrastructure and an em-. envelope pattern — to mass-deliver AI-generated phishing emails and AI-mass-produced landing pages at scale. Roughly 92% of the campaign's sending volume traced to a single /24 network block, 173.236.20.0/24. The lures impersonate SBA "pre-selected new line of credit" loan offers promising $4-10 million in funding within 48 hours, and the landing pages collect detailed applicant data — business/entity name, revenue figures, requested loan amount, credit score, and contact details — that Fortra and Microsoft both assess is intended to enable future, more convincing spear-phishing against the same small businesses rather than immediate financial theft. Microsoft reports that more than 99% of the ASCII-smuggling-laden messages were still caught by layered Defender protections that did not rely on catching the tag characters directly — sender/IP/URL/domain reputation, authentication checks, ML-based spam/phishing classification, brand-impersonation detection, and OCR-based extraction of visible text from rendered message content — and recommends that defenders normalize (strip or fold) Unicode Tags-block characters before applying keyword signatures or feeding content to AI-based classifiers or assistants, since the same evasion primitive can be repurposed against LLM content pipelines. ## MITRE ATT&CK - T1598 Phishing for Information - T1589 Gather Victim Identity Information - T1566 Phishing - T1027 Obfuscated Files or Information - T1684.001 Impersonation - T1583 Acquire Infrastructure - T1585 Establish Accounts - T1588 Obtain Capabilities - T1566 Phishing - T1204 User Execution - T1204 User Execution - T1036 Masquerading - T1056 Input Capture - T1598 Phishing for Information - T1583 Acquire Infrastructure ## Sources - [Phishing Campaign Sends Millions of Emails Using ASCII Smuggling to Evade Detection](https://thehackernews.com/2026/09/phishing-campaign-sends-millions-of.html) - [ASCII smuggling crosses over from AI prompt injection to phishing evasion](https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/) - [Attackers exploit ActiveCampaign to Deliver Thousands of AI-generated SBA Phish](https://www.fortra.com/blog/attackers-exploit-activecampaign-deliver-thousands-ai-generated-sba-phish) - [ASCII smuggling challenges email phishing filters, Microsoft warns](https://www.scworld.com/news/ascii-smuggling-challenges-email-phishing-filters-microsoft-warns) - [Microsoft Finds ASCII Smuggling Repurposed for Phishing Campaign](https://securityboulevard.com/2026/09/microsoft-finds-ascii-smuggling-repurposed-for-phishing-campaign/) - [Fortra Uncovers New, AI-Powered Phishing Campaign Exploiting ActiveCampaign](https://itnerd.blog/2025/09/18/fortra-uncovers-new-ai-powered-phishing-campaign-exploiting-activecampaign/) - [Hackers Abuse AI-Era ASCII Smuggling to Hide Phishing Content in Millions of Emails](https://gbhackers.com/ai-era-ascii-smuggling/) ## Full data Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp Canonical: https://intel.threadlinqs.com/threat/TL-2026-2338