Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters
Summary: Microsoft reported a high-volume phishing campaign that inserts invisible Unicode tag characters (U+E0000 to U+E007F) inside financial keywords like "funding" so email filters matching literal strings no longer see the contiguous word. The activity began in early February 2026, ran at weekday volumes estimated between 1 and 2.37 million messages with a peak on February 26, 2026, and dropped sharply after May 15, 2026, with emails relayed through ActiveCampaign and hundreds of disposable finance-themed sender domains.
Key Takeaway: Filters that match literal keywords or regexes without accounting for interleaved invisible code points will miss a word like "funding" split by a single tag character, and because the mail originates from a reputable marketing platform with established IP reputation, reputation-based filtering is harder to rely on.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026