Million-dollar phishing campaign uses invisible Unicode characters to bypass email filters

Microsoft tracked a high-volume phishing campaign active from February to May 2026 that inserted invisible Unicode characters from the U+E0000–U+E007F block (Unicode Tags) into lure keywords such as 'funding' and 'loan' to evade detection by email filters. These invisible characters fragment ASCII strings at the code-point level without altering the visible text, causing literal or regex-based filters to miss phishing-related keywords. The campaign sent millions of emails daily on weekdays, using hundreds of disposable domains related to finance and routed through ActiveCampaign's infrastructure, which provided reputational cover. The phishing lures aimed to collect credentials and financial information, potentially enabling more targeted follow-on attacks. This is not a software vulnerability but an abuse of Unicode processing inconsistencies across systems. ActiveCampaign stated that their moderation treats obfuscated messages similarly to unmodified ones and flags extensive use of such code points as suspicious. Effective detection involves maintaining both raw and sanitized text representations to identify discrepancies caused by invisible characters.

The campaign enabled phishing emails to bypass traditional email filters that rely on contiguous ASCII keyword matching, increasing the likelihood that malicious messages reached recipients. This facilitated large-scale credential and financial data theft, potentially leading to more precise spear-phishing attacks. The use of a reputable marketing platform for message delivery further complicated detection and blocking efforts. There is no direct software vulnerability or patch; the impact lies in reduced effectiveness of static email filtering rules and increased risk of successful phishing attacks.

No patch or software update is applicable since this is not a software vulnerability. Mitigation should focus on email filtering improvements: security teams should implement detection mechanisms that analyze the raw Unicode content of emails, identify and flag or remove invisible Unicode Tag characters (U+E0000–U+E007F), and compare sanitized versus original text to detect obfuscated keywords. Filtering rules should not rely solely on contiguous ASCII sequences but account for Unicode fragmentation. Monitoring for suspicious disposable sender domains, unsolicited loan offers, and redirects through known tracking domains (acemlnd[.]com, activehosted[.]com) can aid detection. ActiveCampaign’s moderation reportedly treats such obfuscated messages similarly to normal ones and flags extensive use of these characters as suspicious, but additional controls at the recipient’s email gateway are recommended.