A phishing campaign that ran for three months this year used invisible Unicode characters to hide financial lure words from email filters, and Microsoft's security researchers only caught it because they were hunting for something else entirely. The technique, which became well-known in AI prompt injection research as "ASCII smuggling," was repurposed to split words like "funding" with hidden characters so that signature-based detectors and machine-learning classifiers could not recognize them.

The discovery emerged from work on Microsoft Defender for Office 365 prompt injection protection. Researchers built a hunting signature to detect hidden instructions smuggled into email content using the Unicode Tags block, a range of characters (U+E0000 through U+E007F) that do not render visually in most fonts. On February 9, 2026, that signature went from firing on roughly 21,000 messages to over 1.3 million in a single day.

The Unicode Tags block and why it matters

The Unicode Tags block contains a shadow copy of printable ASCII characters. U+E0041 mirrors the letter A, U+E0061 mirrors a, and so on. The block was originally designed for language tagging in text and is now largely deprecated. The critical property for attackers is that most of these code points produce no visible output when rendered. A string can carry a full hidden message that a human eye never sees, but any software processing the raw text, including language models, will decode and act on it.

That property made the Tags block a staple of prompt injection research throughout 2025. Attackers embedded invisible instructions in web pages, documents, and emails. An AI assistant reading the raw content would execute the hidden commands while a human saw nothing unusual. The technique demonstrated a fundamental gap between what people perceive and what models process.

Microsoft's team built their hunting signature to catch exactly this class of abuse. They ran into an immediate false-positive problem: the subdivision flag emojis for England, Scotland, and Wales are encoded using tag characters. A base flag code point (U+1F3F4) is followed by an invisible sequence spelling out a regional indicator, like "gbwls" for Wales, terminated by U+E007F. After excluding those three flags and filtering out benign artifacts from security researchers testing the technique, the remaining signals pointed at something unexpected.

Splitting words to break classifiers

The flagged messages contained no hidden instructions for AI systems. Instead, the invisible tag characters were inserted inside common financial keywords, splitting them so that a literal signature match or regex would fail. The word "funding" might be transmitted with an invisible TAG SPACE character between letters. A human reading the email sees "funding" normally. A detector matching the literal string sees a byte sequence that no longer contains the contiguous keyword.

The real damage, though, goes beyond breaking string matches. Modern spam and phishing classifiers rely heavily on ML and NLP models that tokenize text into sub-word pieces. A clean word like "funding" maps to a familiar token or a predictable sequence of sub-tokens. Insert an invisible character, and the tokenizer might split the text into "fun," an unknown tag character, and "ding," or emit rare sub-tokens that the classifier does not associate with financial phishing. Unless the filtering system renders the message as an image and runs OCR over the visual output, it may miss the manipulation entirely.

Inserting invisible or look-alike characters to break keyword matching is not new in spam and phishing. Zero-width spaces (U+200B), zero-width non-joiners, no-break spaces (U+00A0), soft hyphens, and homoglyph substitutions have been used for years. What distinguishes this campaign is the specific character range chosen. The Unicode Tags block was not commonly abused for filter evasion before AI security research put it in the spotlight. Attackers noticed that the same technique used to hide instructions from humans while exposing them to models also works to hide keywords from classifiers while keeping them readable to recipients.

Scale and discipline over three months

The campaign showed strict weekday activity. Volume peaked on weekdays and dropped to near-zero every Sunday, resuming at full strength the next day. This pattern is typical of scheduled bulk-sending infrastructure. Weekday volumes ranged from 1 to 2.37 million messages, peaking on February 26. After the initial surge, numbers declined gradually to roughly 80% less per weekday by late March. The high-volume usage of the tag-character technique dropped sharply after May 15, with lower residual activity through mid-June.

The campaign operated across roughly 150 finance-themed sender domains. Every domain was built by recombining the same set of 28 word tokens: advance, boost, business, capital, catalyst, choice, digital, direct, elevate, express, finance, funding, growth, guardian, harbor, loan, loans, loc, online, our, pulse, rocket, rush, the, united, wave, way, your. On February 9 alone, guardiangrowthfunding.com generated over 30,000 hits, digitalcapitalboost.com produced over 27,000, and thebusinessloanexpress.com accounted for more than 25,000.

The lures resembled business loan, line-of-credit, and advance-funding phishing patterns commonly associated with fraud or credential-harvesting operations. This accounted for approximately 96% of the volume flagged by the hunting signature. Other hits came from unrelated senders, mainly email-security gateways and personal mailbox providers, not the campaign itself.

Riding a legitimate platform's reputation

The sender domains visible to recipients were not the actual sending infrastructure. The mail was relayed through ActiveCampaign, a legitimate email-marketing platform used by thousands of businesses. ActiveCampaign rewrites outbound links to route through its own click-tracking domains, so the URLs recipients click point at acemlnd.com or activehosted.com, not the branded sender domain. Envelope senders used the format em-..

By originating from a reputable platform with established IP reputation and proper authentication, the campaign bypassed reputation-based filtering that would have blocked messages from freshly registered disposable domains. ActiveCampaign confirmed that messages containing invisible Unicode characters receive the same moderation verdicts as their unobfuscated equivalents, and heavy use of the technique itself is treated as a suspicious signal. The company said it is expanding its use of AI and machine learning to identify abusive sending behavior earlier in the account lifecycle.

What defenders should verify

The defensive opportunity is real. This type of invisible-character manipulation appears rarely in legitimate email traffic, making its presence a high-confidence detection signal. A technique intended to make messages look more benign to ML models can instead give defenders a low-false-positive indicator to act on. Microsoft noted that the majority of flagged messages were caught by layered protections rather than a single Unicode-specific signal.

But the technique also exposes a potential blind spot. The Unicode Tags block is less commonly abused than zero-width spaces or no-break spaces. Defenders should verify that their normalization and tokenization pipelines handle tag characters consistently. If a classifier strips or ignores these characters without logging their presence, a phishing email with invisible word-splitting characters will score as clean. If the classifier does not normalize them before tokenizing, the resulting sub-word pieces will not match known phishing patterns.

The three-month run of this campaign demonstrates that techniques emerging from AI security research do not stay confined to that domain. Attackers study the same papers, attend the same conferences, and use the same tools. When a technique like ASCII smuggling gets enough attention for its prompt injection potential, its secondary applications for filter evasion follow quickly. The Unicode Tags block moved from obscurity to a standard part of the attacker toolkit in under a year.