Hackers Use Invisible Unicode Characters to Evade Phishing Detection in Millions of Emails

Cybersecuritynews •Tushar Subhra Dutta • September 4, 2026

Attackers are using invisible Unicode characters to make phishing emails appear harmless while disrupting the security systems built to spot suspicious language. The campaign pushed finance-themed messages at massive scale, showing how a tiny change inside a word can weaken standard filtering. Recipients saw ordinary offers for funding, loans, or credit, but the underlying text […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Campaign Exploits ASCII Smuggling to Evade Detection Microsoft has identified a high-volume phishing campaign utilizing ASCII smuggling, a technique that employs invisible Unicode tag characters to evade email filters. The attackers split financial lure words like 'funding' using these characters, making the emails appear normal to recipients while bypassing detection systems. This campaign peaked in late February 2026, with over 2.37 million messages sent in a single day, and continued at elevated levels until mid-June. The attackers leveraged the ActiveCampaign marketing platform to distribute AI-generated phishing emails targeting Small Business Administration loan applicants. Microsoft observed a significant increase in flagged messages, indicating the effectiveness of this method against traditional and AI-based filters. The campaign highlights the adaptation of AI-era evasion techniques into conventional phishing strategies, emphasizing the need for enhanced detection measures. 35 sources 68

Hackers Use Invisible Unicode Characters to Evade Phishing Detection in Millions of Emails

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)