Phishing Campaign Exploits ASCII Smuggling to Evade Detection

• •Attackers used invisible Unicode characters to split keywords in phishing emails.
• •The campaign peaked at 2.37 million emails in one day, indicating massive scale.
• •Microsoft's findings show the crossover of AI security techniques into traditional phishing.

Microsoft has identified a high-volume phishing campaign utilizing ASCII smuggling, a technique that employs invisible Unicode tag characters to evade email filters. The attackers split financial lure words like 'funding' using these characters, making the emails appear normal to recipients while bypassing detection systems. This campaign peaked in late February 2026, with over 2.37 million messages sent in a single day, and continued at elevated levels until mid-June. The attackers leveraged the ActiveCampaign marketing platform to distribute AI-generated phishing emails targeting Small Business Administration loan applicants. Microsoft observed a significant increase in flagged messages, indicating the effectiveness of this method against traditional and AI-based filters. The campaign highlights the adaptation of AI-era evasion techniques into conventional phishing strategies, emphasizing the need for enhanced detection measures.