Hackers Use Invisible Unicode Characters to Evade Phishing Detection in Millions of Emails

Microsoft built a prompt injection detector. Then it caught a phishing campaign instead.

Microsoft flagged a phishing campaign last week that exploits a gap in how machines read text. Attackers are slipping invisible Unicode tag characters into email bodies; they don’t render on screen but change the underlying string that software processes. The company says attackers are already using the technique at scale to bypass spam filters and ML-based classifiers, and the same approach could cause problems for AI systems that regularly ing…

Microsoft Warns Of Unicode Phishing Campaign Evading Filters

Microsoft has identified a high-volume phishing campaign using invisible Unicode tag characters to bypass email security filters. Dubbed “ASCII Smuggling,” […]

Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters

Microsoft is alerting of a "high-volume phishing campaign" that's using invisible Unicode tag characters to bypass email filters. "Instead of using these characters to hide instructions from people while exposing them to AI models, the attacker used them to split financial lure words such as 'funding' to prevent email filters from parsing them," the Microsoft Security Research team said. The

Hackers Use Invisible Unicode Characters to Evade Phishing Detection in Millions of Emails

Attackers are using invisible Unicode characters to make phishing emails appear harmless while disrupting the security systems built to spot suspicious language. The campaign pushed finance-themed messages at massive scale, showing how a tiny change inside a word can weaken standard filtering. Recipients saw ordinary offers for funding, loans, or credit, but the underlying text was altered. This is not malware delivered through an attachment. It…

100 % of the sources are Center

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage