Hackers Use Invisible Unicode Characters to Evade Phishing Detection in Millions of Emails

Attackers are using invisible Unicode characters to make phishing emails appear harmless while disrupting the security systems built to spot suspicious language.

The campaign pushed finance-themed messages at massive scale, showing how a tiny change inside a word can weaken standard filtering. Recipients saw ordinary offers for funding, loans, or credit, but the underlying text was altered.

This is not malware delivered through an attachment. It is a phishing evasion method that changes how malicious text is encoded. The emails were sent in huge weekday bursts from disposable, finance-branded domains and passed through shared marketing infrastructure.

That combination gave criminals both reach and a more credible appearance, raising the risk of fraud, credential theft, and costly business mistakes.

Microsoft said in a report shared with Cyber Security News (CSN) that it identified a high-volume phishing operation abusing invisible Unicode tag characters, a tactic often called ASCII smuggling.

Researchers found the activity while examining protections for hidden prompt-injection content in email. The discovery shows that techniques first discussed around AI systems can quickly be repurposed for routine inbox attacks.

The scale was striking. Microsoft’s detection signature recorded roughly 21,000 hits on February 8, then more than 1.3 million the following day.

Activity later exceeded 2.3 million messages in a day and stayed elevated for about three months. The campaign largely followed a weekday schedule, dropping sharply during weekends before returning on Monday.

Hackers Use Invisible Unicode Characters

The attack works because the inserted characters do not normally appear on screen. A recipient sees a familiar financial term, while a filter looking for the exact text may see separate fragments instead.

This gap between visible content and machine-readable content helps attackers reduce the value of simple keyword rules, signatures, and text-based checks.

In the observed emails, criminals placed an invisible character inside high-interest financial wording rather than hiding a complete secret instruction.

The altered word still looked normal to the target, but its digital form changed enough to confuse some detection pipelines. A previously reported invisible character phishing technique illustrates how attackers have increasingly used hidden text to break up warning signs.

The method may also affect machine-learning filters. Many mail systems divide text into smaller pieces before deciding whether a message is spam or phishing.

When attackers split a familiar word with a hidden character, the system may no longer recognize the usual pattern. However, this unusual text can also become a strong signal for defenders because it is rare in legitimate email.

Microsoft linked this phase to a broader campaign using business-loan and funding lures. The campaign relied on hundreds of rotating domains assembled from a small set of finance-related words.

Its delivery method is a reminder that criminals often blend technical evasion with familiar social-engineering pressure, much like the tactics seen in a recent device code phishing campaign targeting business users.

Detection Must Look Beyond Keywords

The key defensive step is to normalize email text before applying keyword, signature, or regular-expression checks. Security teams should remove or standardize invisible and non-rendering characters in message subjects and bodies.

This ensures that a suspicious word is evaluated in the form a recipient actually sees, rather than in its deliberately fragmented version.

Defenders should also treat unexpected hidden characters as an anomaly worth investigating, while accounting for legitimate uses such as certain regional flag emojis.

A single signal should not decide whether an email is malicious. Sender reputation, authentication results, URL checks, message volume, domain behavior, and visual content analysis can provide a fuller picture.

Organizations should test their email gateways, security analytics, and AI systems to confirm that they process hidden characters consistently.

The same normalizing control can reduce exposure to both phishing evasion and prompt-injection attempts in AI tools that read email content. Recent coverage of a session hijacking phishing kit shows why layered defenses remain essential when email campaigns evolve.

Employees still play an important role. An unsolicited funding offer, loan notice, or credit-line message should be checked carefully before a link is opened or credentials are entered.

Security teams should review abrupt changes in mail volume and new finance-themed sender domains, especially when several signals appear together.

The broader rise in inbox threats was also reflected in Microsoft’s email phishing threats report, underscoring that phishing remains a high-volume and adaptable risk.

Indicators of compromise (IoCs):-

Audit the Mirage2FA attack: a session-hijacking checklist for your M365 security team

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Use Invisible Unicode Characters to Evade Phishing Detection in Millions of Emails appeared first on Cyber Security News.