The Phishing Emails Hiding Characters You Cannot See

Somewhere in a finance inbox this year, the word "funding" was not quite the word "funding". It looked normal on screen and read normally out loud. But sitting between the "fun" and the "ding" was a character that takes up no space, prints nothing, and exists for one purpose: so that a security filter reading the raw text sees two fragments instead of one recognisable lure. On 3 September 2026, Microsoft published research describing a high-volume phishing campaign built on exactly that trick.

The technique is called ASCII smuggling. It started life in AI security research as a way of hiding instructions from people while leaving them readable by a language model. What Microsoft found was the same mechanism turned around and pointed at email filters instead.

What ASCII smuggling actually is

The Unicode standard includes a block of characters known as tags, running from U+E0000 to U+E007F, which mirrors ordinary ASCII. Most software does not draw them. Paste a sequence of them into a document and you see an empty space where several letters are sitting.

Security researcher Johann Rehberger popularised the technique and built the tooling for it, publishing his ASCII Smuggler tool in January 2024. The original application was prompt injection: bury an instruction in text a person skims past without seeing, and that a model happily ingests. We have written before about how that plays out in AI assistants that read your inbox.

The block does have legitimate uses. The flag emojis for England, Scotland and Wales each encode the region name as an invisible tag sequence, so a detection rule for these characters produces a harmless trickle of matches, which gives defenders a baseline to measure spikes against.

What Microsoft found in the mail flow

Microsoft built its hunting signature for the tag block as part of prompt injection protection work on Defender for Office 365. The signature was looking for hidden instructions aimed at AI systems. It found finance-themed phishing instead.

On 8 February 2026 the signature fired on roughly 21,000 messages. The following day it fired on more than 1.3 million, peaking at over 2.3 million on 11 February, with weekday figures running between 1 and 2.37 million through the opening phase. Most of it clustered into around 150 finance-themed sender domains.

The campaign kept office hours, running hard on weekdays and going almost silent every weekend, which points to scheduled bulk-sending infrastructure rather than hands-on-keyboard work. It then decayed slowly through the spring, with the high-volume phase dropping away sharply after 15 May 2026.

Then came the part that inverted the assumption. When Microsoft's team sampled the flagged messages, there were no smuggled instructions to an AI assistant at all. The invisible characters had been dropped inside common financial keywords, splitting them apart. A single Unicode tag space, U+E0020, placed in the middle of a word like "funding" was enough.

Why splitting a word matters to a filter

Any detection built on literal matching fails the moment the string it is looking for stops being that string, so a keyword rule for a known loan-scam term simply does not fire. Microsoft's assessment is that the larger prize was the machine learning models that increasingly do the classifying, because what they receive depends on how the pipeline handles Unicode before analysis begins. If normalisation runs first, the character is stripped and the model reads "funding" as it always did. If it does not, the model may see two fragments, or unusual sub-tokens it has little training signal for.

There is a defensive opportunity buried in this, and Microsoft makes the point directly. Tag characters are vanishingly rare in ordinary business mail, so a technique designed to look innocent to a classifier ends up leaving a loud fingerprint for anyone watching for it. Microsoft reports that over 99% of the messages were caught by layers that never depended on spotting the tag characters at all, including sender and domain reputation, URL analysis and brand impersonation checks.

How the messages were delivered

The sender domains were disposable and interchangeable. Twenty samples from a single day were built from just 28 word fragments (advance, boost, capital, guardian, harbor, rocket and so on) recombined and rotated as each one burned out. The mail itself was relayed through infrastructure associated with ActiveCampaign, a widely used email-marketing platform that rewrites outbound links to run through its own click-tracking domains, so the URL a recipient clicked did not point at the branded sender at all. Microsoft shared its findings with the platform before publishing. Nothing here is a flaw in the product; established sending services carry good reputation because they are used legitimately, which is what makes them worth abusing.

The trick is aimed at machines, not at people

Nothing about the invisible characters alters what the recipient sees. Microsoft's own description is that the manipulation does not raise a user's suspicions, and it cannot, because the message renders exactly as it would have without it.

Which means every cue a person actually uses is still intact. An unsolicited offer of business funding from a company nobody has heard of. A sender domain that reads like it was generated from a word list, because it was. A link that leads somewhere other than the brand in the header. The NCSC's guidance on spotting scam messages points at authority, urgency, emotion and scarcity, and a character you cannot see affects none of those.

What the technique changes is arithmetic. Evasion that works even part of the time means more messages complete the journey to an inbox rather than stopping at a gateway. The person at the end of that journey is not the last line of defence, and framing them that way helps nobody, but their judgement carries more weight when the layers ahead of them are being deliberately confused. A reported message is worth more than usual here too: it is a live sample carrying an evasion characteristic a defender can hunt for across the rest of the estate.

What to do about it

• Normalise before you match. Strip invisible and non-rendering code points, including the tag block U+E0000 to U+E007F and zero-width characters, out of subject lines and bodies before any keyword or regex logic runs over them.
• Treat tag characters as an anomaly in their own right. Outside a handful of legitimate uses, they should almost never appear in business email, so their presence is a high-confidence signal rather than noise.
• Apply the same normalisation upstream of anything AI reads. The control that defeats this evasion also reduces prompt injection exposure for assistants and agents that ingest mail. That overlap is the point of the finding.
• Do not depend on a single detection layer. The reason this campaign was largely contained was breadth: reputation, URL analysis, authentication checks and impersonation models running alongside content signatures.
• Brief finance and accounts teams specifically. The campaign was built around business loans, credit lines and advance funding, so the people who handle those conversations daily are the ones who will see it.
• Make reporting a one-click habit, and thank people for it. Suspicious mail in the UK can also be forwarded to report@phishing.gov.uk. A reporting culture turns near-misses into estate-wide detection.

The bottom line

The interesting thing about this campaign is not its sophistication. Inserting one invisible character into a word is about as simple as an evasion gets. It is the crossover that matters: a technique documented in AI security research turned up, within a couple of years, in bulk phishing aimed at ordinary finance inboxes. Attack methods do not stay in the domain they were invented in.

The practical response is unglamorous. Normalise text before you analyse it, watch for characters that should never be there, and keep enough independent layers running that no single evasion pays off. For everyone reading their mail, the message is steadier than it sounds: the trick was never aimed at you, and the things you already look for still work.

Phishing Tackle offers the tools businesses need to strengthen their human risk strategies, with multi-platform testing, real-time behavioural insights, and actionable data to keep your organisation ahead of modern cyber threats.

Contact us today to learn how Phishing Tackle can help safeguard your organisation from the growing array of cyber risks.