Phishing lures reportedly hide words with invisible Unicode

Emails that look unchanged but contain different text

According to the report, a large-scale finance-themed phishing campaign used ASCII smuggling: invisible Unicode tag characters were inserted within terms such as “funding” so that word-list filters could miss them. Microsoft reportedly observed the technique in millions of messages, with daily volume peaking at up to 2.37 million in late February; the operation was said to remain active after volumes declined.

Microsoft's telemetry reportedly showed that the broader campaign had existed before the observed use of this specific Unicode-tag technique.

Attackers reportedly added invisible Unicode characters inside finance-related lure words, allowing the words to be visually intact while split for keyword-based email filtering.

Text handling before scanning comes into focus

The recipient can read an ordinary word while a simple detection rule receives a different string. The report says normalizing or stripping invisible characters before scanning may reduce that blind spot.