FILTER EVASION - MICROSOFT RESEARCH

21,000 emails on Monday. 1.3 million on Tuesday. The difference was a character you cannot see.

Microsoft tracked a phishing operation dropping invisible Unicode inside ordinary words to break keyword matching. The messages read perfectly normally, because for once the trick was never aimed at the reader.

SB

SafeBrowz Threat Research Security Research · 13 September 2026 · 10 min read

The character that is a copy of nothing

Unicode contains a block called Tags, running from U+E0000 to U+E007F. Microsoft describes it as "a shadow copy of the printable ASCII characters". There is a tag version of the letter a, a tag version of the letter b, a tag version of the space, and so on through the printable set.

It was created for language tagging, a purpose that was abandoned long ago, and the block is now largely deprecated. What it kept is one property that matters enormously here: these characters render as nothing. Not as a box, not as a question mark. They occupy no visual space at all.

So a string can carry content a human cannot read. Put the tag version of a space between the third and fourth letters of a word and you get this:

funding becomes fun + U+E0020 + ding

Your eye sees funding. A filter looking for the literal string funding sees fun and ding, two words it has no rule about. Microsoft's phrasing is exact: "to a recipient, and to parsing pipelines that drop or normalize these characters, the word still reads as funding."

Note what the operators did not do. They did not smuggle whole hidden messages, which is the version of this trick you may have read about in the context of AI. They used a single separator, sprinkled into the handful of words a spam filter is most likely to be watching for.

What the numbers looked like

The analysis was published on 3 September 2026 by Microsoft Security Research, written by Noam Kochavi and Sarah Wolstencroft. The shape of the telemetry is worth reading slowly.

• 9 February 2026: their hunting signature for ASCII smuggling fired on roughly 21,000 messages.
• The next day: more than 1.3 million.
• 11 February: over 2.3 million.
• Then roughly three months of elevated weekday volume, before it dropped sharply after 15 May 2026.

A sixty-fold jump inside a day is not gradual adoption. That is one operator flipping a setting on tooling they already had, on a sending pipeline that was already running. The technique was not the campaign. It was a switch added to a campaign.

Where this trick came from, and why that matters

Microsoft titled their write-up around the crossover, and it is the most interesting thing about the story. Invisible Unicode was already a known problem in a completely different field: prompt injection against AI systems, where hidden characters carry instructions a model reads and a person never sees.

That is an attack on a machine that reads text too literally. And a keyword-matching spam filter is, in the end, exactly the same kind of machine. So the technique transferred without needing to be reinvented, from making an AI read something to making a filter fail to read something.

It is a useful thing to notice about how attack techniques travel. They move between targets that share a weakness, not between targets that look alike.

The lure, and the domains behind it

The pitch was business funding: loans, lines of credit, advance funding. Fortra had documented the wider operation back in September 2025, when it was sending AI-generated phishing at Small Business Administration loan applicants, which tells you the operators had been at this for some time before the invisible characters appeared.

The sender domains were built to match the pitch and registered for it. Three of the highest-volume ones from Microsoft's table of 9 February:

• guardiangrowthfunding[.]com
• digitalcapitalboost[.]com
• thebusinessloanexpress[.]com

All three are on our blocklist and return danger, which we added while writing this. All three still resolve, and what they serve is instructive. Two of them load complete, polished funding businesses, one of which advertises "Over $2 Billion Funded" above a call button and an application form. The third serves an empty response, nothing at all, which fits a domain whose only real job was to appear in a From header. A single operation, and its web presence ranges from a convincing company to a blank page.

The part that is easy to get wrong

The messages went out through activecampaign.com, a legitimate email marketing platform, and the links were rewritten through its normal click-tracking domains. That rewriting is a standard product feature, not a flaw, and it is used by an enormous number of honest senders every day.

ActiveCampaign also tested the specific technique and said that messages containing invisible Unicode characters "receive the same moderation verdicts as their unobfuscated equivalents", meaning their own moderation was not fooled by it.

This distinction is not a footnote, it is the difference between a useful defence and a broken one. Roughly 92 percent of the measured volume came from a shared egress IP range that belongs to legitimate infrastructure. Block the platform, the tracking domains, or that address range and you would break a great deal of real mail while the operators simply move. The attacker-registered sender domains are the part that is actually theirs, which is why those are the three we blocked and the platform is not.

Why the usual advice does not fit this one

Most phishing guidance assumes there is something for you to catch: a wrong tone, a misspelling, a strange greeting, a name that does not match. That advice is built on the idea that the attacker is trying to fool you.

Here they are not. The invisible character does nothing whatsoever to a human reader. It exists purely to break string matching in software. By the time the message reaches your inbox, the trick has already either worked or failed, and the email in front of you is simply an email.

Which leaves a short list of things that still carry information:

1. You were approached. Real lenders do not cold-email pre-approved funding to people who did not apply. The offer being unsolicited is the strongest signal in the whole message, and it survives any amount of technical cleverness.
2. The sender domain has no past. A domain registered for a campaign has nothing behind it, however well the copy reads. This is the same tension we walked through with cloned dealership sites, where a perfect page sits on a brand-new address.
3. The link goes somewhere. Tracking rewrites mean the visible link tells you little, so the destination is worth resolving before you commit to it rather than after.

Block the sender domain, because the text will not help you

Worth being clear about our limits here, since this attack lives partly in a place we do not reach.

We do not read your mailbox and we cannot inspect the raw bytes of an email, so we are not the thing that catches the invisible character. That job belongs to your mail filter, and Microsoft's advice to defenders is the right one: normalize before you match, stripping or folding invisible and non-rendering code points before any keyword or regex logic runs, and treat the presence of tag-block characters as a strong anomaly in its own right.

What we can settle is what happens after the message survives the filter, which in this campaign was the point of the whole exercise. Layer 1 runs local checks in the browser before a page renders. Layer 2 checks the address server-side against reputation sources, our blocklist and a brand database of more than 550 names, and it is the layer holding the three domains above. Layer 3 is the AI deep scan, which reads what a page actually serves, one free scan a day for everyone and unlimited on Premium at $14.99 a year across up to three devices.

And the honest weak spot, stated plainly rather than glossed. A funding-application page is not deceptive to read. There is no fake login, no countdown, no impersonated brand, just a business offering loans. Before we added the blocklist entries, our own scan returned safe on all three of these domains, and we would rather write that down than imply the AI caught them. It took Microsoft's provenance to make them danger. Content-based detection is simply the wrong instrument for a page whose only lie is who sent you to it.