Microsoft Describes Phishing Using Invisible Unicode Characters
Microsoft analyzed a phishing campaign that inserted invisible Unicode Tags characters into financial terms to make email filters’ work more difficult.
On September 3, 2026, Microsoft Security Research published an analysis of a campaign using Unicode Tags characters. In emails, the attackers used an “ASCII smuggling” technique: they inserted invisible characters from the Unicode Tags range U+E0000 to U+E007F into ordinary finance-related words. The goal was to disrupt literal term searches and potentially change how filters process the text.
According to Microsoft, this technique had previously been associated mainly with prompt injection attacks against artificial intelligence systems. In the documented case, however, it appeared in mass phishing, where it may complicate message-content inspection.
Unicode Tags Can Disrupt Readable Text for Filters
Unicode Tags characters are invisible to people in ordinary display. A recipient may therefore see an apparently normal word, while its actual character representation contains inserted invisible Unicode Tags characters. A filter that searches for an exact text sequence without prior normalization may fail to recognize the originally expected term.
Microsoft also warns of a possible impact on text tokenization, meaning the division of content into parts processed by security mechanisms or language models. However, this is not a universal bypass of email protection. The effect depends on the specific product and on whether it normalizes, removes, or identifies invisible Unicode characters as an anomaly.
More Than 2.3 Million Messages in Telemetry
Microsoft Defender for Office 365 telemetry showed a sharp increase in activity from the relevant detection rule starting February 9, 2026. The peak reportedly exceeded 2.3 million messages on February 11. Microsoft linked this phase to a larger phishing campaign whose messages were delivered through the abused legitimate email marketing platform ActiveCampaign.
This does not mean that ActiveCampaign originated the campaign. Microsoft describes the platform as abused delivery infrastructure. Independent public confirmation of the telemetry’s exact scope or a complete independent attribution of the campaign to a specific actor is not currently available.
Recommendation: Normalize Content Before Analysis
Microsoft states that Defender for Office 365 includes heuristic detections for the described tactics. It also recommends that organizations normalize or remove invisible Unicode characters before analyzing content. This step is intended to ensure that rules and other control mechanisms work with a comparable text representation of the message.
The case is also relevant to environments that pass email content to AI assistants or other systems for automated processing. The abuse of Unicode Tags shows that checking for invisible characters is not only a matter of protection against prompt injection, but also of traditional email security.
Further developments will show whether other email-security providers independently confirm the abuse of Unicode Tags, whether attackers move to other invisible characters, and whether they change their delivery infrastructure. Updates to detection and normalization recommendations from email-protection providers will also be important.
Sources
- Microsoft Security Blog – Microsoft’s initial technical analysis, the telemetry timeline, a description of the Unicode characters, the connection to the delivery infrastructure, and recommended mitigations.
Verified and updated: 09/04/2026 06:21
