Invisible Unicode, Visible Risk: How an AI-Era Technique Helped Phishing Reach Millions of Inboxes

The Campaign at a Glance

Microsoft detected a sharp increase in emails containing characters from the Unicode Tags block beginning on February 9, 2026. Activity remained elevated for approximately three months before dropping significantly after May 15, with lower residual volumes continuing into June.

During the most active period, the campaign:

The regular weekday schedule and near-total weekend pauses strongly suggest automated bulk-sending infrastructure operating according to a predefined timetable.

It is important to understand what the reported numbers represent. The millions cited by Microsoft are detected messages—not confirmed victims, successful compromises or necessarily unique recipients.

How Invisible Unicode Broke Visible Words

The campaign used characters from the Unicode Tags block, covering the range U+E0000–U+E007F. These code points were originally intended for language-tagging purposes and are now largely deprecated. Most fonts and user interfaces do not visibly render them.

The attackers inserted an invisible tag character inside financially relevant words. For example, the word “funding” could be represented internally as:

fun<U+E0020>ding

To the recipient, the text still appeared as “funding.” Underneath that visible representation, however, the continuous word no longer existed as the same character sequence.

This relatively small modification can interfere with several types of security analysis:

A human sees “funding,” while a tokenizer may process something closer to:

fun | unusual character | ding

This is often described as ASCII smuggling because it uses the Unicode range associated with that technique. Strictly speaking, however, the campaign was not encoding a complete hidden message or instruction. It was using individual tag characters as invisible separators. “Invisible-character obfuscation using the Unicode Tags block” is therefore a more precise description of the observed behavior.

Old Evasion Technique, New Character Set

Breaking suspicious words with invisible or visually confusing characters is not new. Spam and phishing campaigns have previously used:

What makes this campaign different is the particular Unicode range being used and the scale at which it was deployed.

Unicode tag characters became widely discussed during research into prompt injection and AI-system security. In that context, an attacker might place invisible instructions inside a webpage, document or email. A person sees nothing unusual, but an AI assistant processing the underlying content may interpret the concealed characters as instructions.

In this campaign, the objective was reversed. The attackers were not trying to expose hidden instructions to an AI model. They were trying to make visible phishing language less recognizable to automated security systems.

This is an example of an AI-era security technique crossing into a traditional attack environment.

The Broader SBA-Themed Operation

Microsoft connected the Unicode activity to a larger campaign previously analyzed by the Fortra Intelligence and Research Experts team.

The operation impersonated U.S. Small Business Administration financing programs and offered recipients access to supposed preselected lines of credit. Some messages promised between $4 million and $10 million in business funding within 48 hours.

Rather than attempting to install malware immediately, the campaign focused on collecting detailed business and financial information.

The attack sequence generally followed this pattern:

The phishing sites asked recipients to provide information such as:

Fortra did not identify an active attempt to infect the endpoint when a recipient clicked the link. The immediate purpose appeared to be reconnaissance and data harvesting.

After information was submitted, the site displayed a message stating that someone would contact the applicant. It also encouraged the recipient to call a telephone number for a faster response, creating a potential transition from email phishing to vishing.

The information collected through the questionnaire could make subsequent attacks considerably more convincing. An attacker who knows a company’s revenue, desired loan amount, credit expectations and decision-maker can construct a highly personalized follow-up conversation.

AI as an Operational Multiplier

AI’s principal role in this operation was not the invisible Unicode technique itself. It was the ability to rapidly create and vary the surrounding campaign.

Fortra found evidence of dynamically generated email content, including a %company% parameter used to insert a target organization’s name. The associated phishing websites followed a common structure but varied their branding, images, text and user-interface details.

This allowed the operators to:

Some sites placed all questionnaire fields on one page, while others presented them through a series of “Next” screens. Stock images, faces, branding and page layouts also changed between instances.

The result was not necessarily a technically sophisticated phishing site. The important change was the speed, volume and variability with which credible-looking sites could be produced.

Abuse of Legitimate Marketing Infrastructure

The attackers relayed the messages through infrastructure associated with ActiveCampaign. Links were rewritten through the platform’s normal tracking domains, including:

This complicated reputation-based filtering.

A link passing through an established marketing service does not initially resemble a direct connection to a newly registered phishing domain. Similarly, messages sent through a legitimate provider may inherit established infrastructure reputation and valid email authentication.

SPF, DKIM or DMARC validation can confirm that a message was authorized by the sending platform. It does not prove that the platform’s customer or the customer’s campaign is trustworthy.

Microsoft emphasized that the shared infrastructure should not be treated as malicious by itself. ActiveCampaign also stated that its moderation systems assign messages containing invisible Unicode the same verdict as their unobfuscated equivalents and treat heavy use of the technique as suspicious.

The research therefore does not prove that the Unicode technique directly bypassed ActiveCampaign’s own moderation. It shows how criminals combined a legitimate delivery service with content manipulation and disposable identities to make downstream filtering more difficult.

A Detection Weakness—and an Opportunity

Although invisible tag characters can interfere with poorly normalized detection pipelines, their presence can also become a strong defensive signal.

Unicode tag characters are extremely rare in ordinary business correspondence. One legitimate exception involves the emoji sequences used to display the flags of England, Scotland and Wales. Security systems must exclude such expected sequences to avoid unnecessary false positives.

After those exclusions, a tag character inserted inside an ordinary financial word should be treated as a substantial anomaly.

Effective detection should combine multiple signals:

The fundamental rule is straightforward: normalize before matching.

Security products should remove, fold or otherwise account for invisible characters before applying keyword rules, regular expressions, NLP tokenization or machine-learning classification. They should also retain the original representation for investigation because the presence and location of those characters provide valuable evidence.

Microsoft reported that more than 99% of the observed messages were identified by other defensive layers, including sender, IP and URL reputation, authentication checks, impersonation detection and machine-learning classification. The Unicode technique therefore exposed a potential detection gap, but it did not make layered email defenses ineffective.

Where FileDNA CADR Fits

This campaign has a meaningful but precisely bounded connection to FileDNA.

If FileDNA is integrated where it can inspect raw email content—including EML or MSG files, MIME parts, HTML bodies and archived messages—it can identify differences between the content stored in a message and the text shown to the recipient.

A FileDNA processing workflow could:

For example, FileDNA could generate a finding such as:

Visible text differs from its underlying Unicode representation. Unicode tag characters were inserted inside finance-related words. The message also contains an external tracking link and business-funding solicitation language.

Where policy permits, FileDNA could reconstruct the content without the invisible tag characters. This would remove the ambiguity exploited by the campaign and allow downstream systems to analyze the same words the recipient sees.

The same canonicalization step also has value for AI security. Before an email, document or webpage is supplied to an AI assistant, FileDNA can identify hidden representations and ensure they are not silently treated as trusted instructions.

What FileDNA Cannot Solve Alone

FileDNA should not be positioned as a complete solution to this campaign.

There was no malicious attachment to disarm, and the initial landing pages did not attempt to install malware. Removing invisible characters does not make a fraudulent loan offer legitimate. CADR also cannot independently stop a recipient from entering information into a website or calling a telephone number.

Protection against the complete operation still requires:

The accurate FileDNA CADR position is that it eliminates the content-representation ambiguity being exploited. It ensures that security tools and AI systems can evaluate what the recipient actually sees, while providing evidence of the manipulation used to conceal it.

FileDNA complements email security, web protection and fraud controls; it does not replace them.

The Larger Security Lesson

The campaign illustrates a broader change in the threat landscape. Techniques no longer remain confined to the environment where they first attract attention.

A Unicode method associated with AI prompt injection was adapted to conventional phishing. AI-generated content helped transform a reusable loan-fraud template into thousands of personalized messages and websites. A legitimate marketing service provided the delivery and tracking infrastructure. The initial interaction collected intelligence rather than deploying malware, creating the foundation for more targeted attacks later.

The security boundary is therefore no longer limited to identifying obviously malicious code or known phishing domains. Defenders must determine whether the content being analyzed is genuinely the same content being presented to a person—or being consumed by an AI agent.

Canonicalization, structural analysis and representation comparison are becoming essential security functions. Before content is trusted, classified or passed to an automated system, its visible, hidden and machine-readable forms must be reconciled.

That is the layer at which this campaign attempted to create ambiguity—and the layer at which FileDNA CADR can contribute meaningful protection.

References