A significant phishing campaign has been reported, leveraging invisible Unicode characters to circumvent email filtering systems. Microsoft has identified this operation as a “high-volume phishing campaign” that began in early February 2026.
Phishing Techniques and Evasion Strategies
The campaign employs a method known as ASCII Smuggling, where invisible Unicode characters are inserted into financial terms to obscure them from detection. For example, the term “funding” can be altered to “fun⟨U+E0020⟩ding,” allowing it to appear normal to users while evading security filters. This technique takes advantage of the fact that many email filters and AI language models may not recognize these hidden characters.
Scope and Scale of the Campaign
According to Microsoft, the phishing campaign reached its peak activity around February 26, 2026, with estimated daily volumes of between 1 to 2.37 million messages. The campaign’s activity showed a weekly pattern, with reduced volumes over the weekend and a resurgence on Mondays. It is noted that the campaign significantly decreased after May 15, 2026.
Targeted Audiences and Implications
The phishing emails are primarily aimed at Small Business Administration (SBA) loan applicants, utilizing the ActiveCampaign marketing platform to distribute AI-generated phishing messages. This method allows attackers to create tailored websites that mimic legitimate domains, enhancing the effectiveness of their schemes. The emails often contain links routed through click-tracking domains associated with ActiveCampaign, complicating detection efforts.
Challenges in Detection and Mitigation
ActiveCampaign has stated that its content moderation systems can identify messages containing invisible Unicode characters, treating them similarly to their unobfuscated counterparts. However, Microsoft warns that the use of reputable marketing platforms can obscure the malicious nature of these emails, making them appear as legitimate marketing traffic. This complicates reputation-based filtering, as attackers can exploit customer accounts or workflows within these platforms.
The findings underscore the evolving sophistication of phishing tactics, particularly in how they adapt to new technologies and security measures.
This article was produced by NeonPulse.today using human and AI-assisted editorial processes, based on publicly available information. Content may be edited for clarity and style.
