Microsoft has recorded a large-scale phishing campaign in which attackers insert invisible characters from the Unicode Tags block (U+E0000–U+E007F) into financial terms in email bodies to evade keyword- and regex-based detection. The campaign generated up to 2.37 million messages per day at its peak, using the infrastructure of the legitimate marketing platform ActiveCampaign for distribution. The technique, previously known in the context of attacks on LLM models via hidden instructions, has been applied for the first time at this scale to bypass traditional email filters. Organizations that rely on signature- and keyword-based filtering need to implement Unicode normalization before the content analysis stage.
Obfuscation mechanism: how inserting invisible characters works
The Unicode Tags block (U+E0000–U+E007F) contains “shadow copies” of printable ASCII characters: for example, U+E0041 corresponds to “A”, U+E0061 to “a”. These characters were originally intended for language tagging and are now considered deprecated. Their key property is that they do not appear in user interfaces.
Attackers insert the U+E0020 character (an invisible space from the Tags block) into highly indicative financial words. For example, the word “funding” becomes “fun⟨U+E0020⟩ding”. To the email recipient, the word looks completely normal, but to a detector that is searching for the continuous string “funding” or applying a regular expression that does not account for the inserted invisible code points, the byte sequence no longer contains the desired keyword.
As Microsoft Security Research notes, the fundamental difference from classic homograph attacks is the choice of the Tags block specifically and the unprecedented scale: not a few targeted emails, but millions of messages per day. In this case, the invisible characters are used strictly as separators inside words, not to encode hidden messages or instructions for AI models.
Microsoft has classified the observed behavior under the MITRE ATT&CK T1566 (Phishing) and T1027 (Obfuscated Files or Information) techniques.
Timeline and scale of the campaign
The active phase that leveraged Unicode Tags characters started abruptly: on February 8, 2026, Microsoft’s telemetry recorded about 21,000 messages, and by February 9 this had jumped to more than 1.3 million. The high-volume phase lasted for roughly three months and dropped off sharply after May 15, 2026, although residual activity was observed at least until mid-June.
The campaign followed a clear weekly rhythm: almost complete silence on weekends and a full resumption of mailings on Mondays. Weekday volumes ranged from 1 to 2.37 million messages per day. Microsoft cites February 26, 2026, as the date of peak volume, although charts in the same report show a spike of more than 2.3 million messages on February 11 — these figures may reflect different measurement metrics.
At the start of the active phase on February 9, Microsoft had identified 148 finance-themed sender domains. In total, the campaign used hundreds of disposable domains assembled from a limited vocabulary of financial terms.
Infrastructure and indicators of compromise
The emails were sent through ActiveCampaign’s infrastructure, which resulted in all outbound links being routed via the platform’s click-tracking domains: acemlnd[.]com and activehosted[.]com. Approximately 92% of the measured traffic originated from the 173.236.20[.]0/24 network block associated with this marketing platform. Microsoft stresses that this block is legitimate shared infrastructure and can be used only for correlation, not as an independent indicator of malicious activity.
Using a reputable marketing platform with established IP reputation and configured authentication (SPF, DKIM) allowed the phishing traffic to resemble legitimate marketing mail, significantly complicating reputation-based filtering.
Top 10 sender domains by number of detections:
- guardiangrowthfunding[.]com
- digitalcapitalboost[.]com
- thebusinessloanexpress[.]com
- yourlocfunding[.]com
- advancefundingboost[.]com
- guardiancapitalway[.]com
- harboradvancefunding[.]com
- unitedfundingwave[.]com
- directcapitalboost[.]com
- onlinedirectfinance[.]com
The lures mimicked offers of business loans, lines of credit, and advance funding — patterns typically associated with fraud or credential harvesting. According to Microsoft, the campaign is linked to a broader phishing operation previously documented by the Fortra FIRE team in September 2025, which targeted the collection of detailed financial and business information from applicants for U.S. Small Business Administration (SBA) loans. It should be noted that this link is based on infrastructure and content correlation by Microsoft; a specific threat actor group has not been identified.
Impact assessment
Organizations that rely on email filtering based on exact keyword or regular-expression matches without prior Unicode normalization are at greatest risk. Small and medium-sized businesses in the financial sector, as well as companies that work with credit products, are priority targets for this campaign.
Microsoft reports that more than 99% of the messages were blocked by multi-layered protection — sender, IP, and domain reputation filtering; machine-learning-based classification; brand-impersonation detection; and authentication checks. However, the very need for multi-layer protection to catch them underscores that no single filtering layer was sufficient.
ActiveCampaign has stated that its content-moderation systems handle messages containing invisible Unicode characters the same way as their unobfuscated counterparts, and that heavy use of the technique is treated as a “suspicious signal”. This is the company’s own statement, not the result of independent verification.
Practical recommendations
- Unicode normalization on input: Microsoft recommends removing or normalizing invisible Unicode code points before applying keyword-, signature-, and regex-based rules, spam filters, and phishing detectors. This is the key measure — without it, any keyword rules can be bypassed.
- Detecting the presence of Tags characters: add rules that flag the presence of characters from the U+E0000–U+E007F range in the email body. Legitimate use of this block is extremely rare — its presence is an anomaly in itself.
- Correlation with domain patterns: combine detection of Tags characters with analysis of finance-themed sender domains and the presence of marketing platforms’ tracking domains in links.
- Multi-layer filtering: do not rely on a single detection method. Combine reputation analysis, ML-based classification, authentication checks (SPF/DKIM/DMARC), and content filtering.
- IOC monitoring: add the listed sender domains to blocklists and configure alerts for traffic from the 173.236.20[.]0/24 network block in combination with financial themes.
This campaign illustrates a concrete vector: techniques developed for attacking AI models via hidden instructions are being adapted to bypass traditional email security controls. The top priority for security teams is to introduce a Unicode normalization stage into the inbound mail-processing pipeline before applying any content-based detection rules. Organizations that use Microsoft Defender for Office 365 should verify that multi-layer filtering policies are enabled and up to date.
