Phishers hijack AI evasion tactics to bypass email filters

Key points

• Microsoft detected a high-volume phishing campaign using invisible Unicode tag characters (U+E0000 to U+E07F) to obfuscate financial lure words.
• The technique, known as ASCII smuggling, was originally developed to hide malicious prompts from AI models but was adapted here to defeat traditional email filters.
• The campaign peaked at over 2.37 million messages per day on February 26, 2026, and maintained a strict weekday-only schedule for three months.
• Attackers used approximately 150 disposable, finance-themed sender domains and relayed emails through the ActiveCampaign marketing platform.
• Microsoft recommends stripping invisible Unicode code points during normalization and tokenization to ensure keyword matching remains effective.

Background

ASCII smuggling gained prominence in 2025 as a method for indirect prompt injection, where attackers hide instructions in invisible characters for AI models to read. This incident marks a significant shift, demonstrating how techniques designed for AI security are being repurposed for traditional cyber-attacks. Earlier coverage noted that while invisible characters like zero-width spaces have long been used for evasion, the specific use of the deprecated Unicode Tags block at this scale is novel. The campaign is linked to a broader SBA-themed phishing operation documented by Fortra in September 2025, which utilized AI-powered marketing automation to generate convincing, tailored phishing sites.

How outlets are covering it

Microsoft and The Register emphasize the cross-domain nature of the threat, highlighting how AI-era evasion techniques are migrating into established phishing ecosystems. Microsoft researchers Noam Kochavi and Sarah Wolstencroft stress the need for a 'cross-domain lens' in defense, noting that the same invisible characters used to trick AI can now bypass keyword filters. Ars Technica focuses on the technical mechanism, explaining how inserting invisible characters disrupts machine learning tokenization, causing filters to misread words like 'funding' as 'fun' and 'ding.' The Hacker News provides broader context, linking the current activity to a larger SBA loan phishing campaign previously identified by Fortra, which used ActiveCampaign’s AI features to scale sophisticated attacks. All sources agree that while the concept of invisible character insertion is not new, the specific use of the Unicode Tags block and the massive scale of the campaign represent a new threat vector.

Why it matters

This incident illustrates the rapid evolution of cyber threats, where techniques developed for one domain (AI security) are quickly adapted for another (email phishing). It highlights a potential blind spot in modern email security systems that rely on machine learning and keyword matching, which may fail to detect obfuscated content if normalization pipelines are not updated. The use of a reputable marketing platform like ActiveCampaign further complicates detection, as the traffic may appear legitimate to reputation-based filters. Defenders must update their normalization and tokenization processes to handle invisible Unicode characters consistently to prevent such evasion.

What to watch

Microsoft has shared its findings with ActiveCampaign, which stated that its content-moderation systems treat messages with invisible Unicode characters the same as unobfuscated equivalents and flag heavy use as suspicious. Defenders are advised to verify that their normalization and tokenization pipelines strip or fold invisible and non-rendering Unicode code points before evaluating content. Additionally, monitoring for behavioral indicators, such as bulk volume from finance-themed disposable domains on a strict weekday schedule, can help identify similar campaigns. The campaign’s high-volume phase ended in mid-May 2026, but residual activity continued through mid-June, suggesting the threat may persist in lower volumes.