Microsoft warns of phishing emails using hidden Unicode tricks

Published August 21, 2026

Microsoft found a massive phishing operation that hides invisible Unicode characters inside words like "loan" or "funding" in emails. The email looks completely normal to a person, but the hidden character can trick automated filters into missing it as spam or phishing.

Report priority
High
Targets
Microsoft+3 more

How it works

Attackers insert an invisible Unicode "tag" character in the middle of a common financial word, so the word displays normally to a reader but is split into different data underneath, which can fool text-scanning spam and phishing filters that check for exact word matches.

What to do

Security teams can check their mail logs and filter rules for unusual hidden Unicode tag characters around financial keywords in flagged or delivered messages.

Treat unsolicited business-loan, funding, or credit emails from unfamiliar domains with suspicion and avoid clicking links or replying with financial details. Organizations should have their email security team normalize and strip invisible or non-rendering Unicode characters before running keyword, signature, or spam-filter checks, per Microsoft's guidance.

Technical details

Affected software: Microsoft, Windows, Android, Node.js

An attacker registers a disposable, finance-branded domain and sends a bulk email offering a business loan or credit line. Inside the message, a word like "funding" has an invisible character stitched into the middle of it, so the recipient just sees a normal offer. A filter scanning for that same word as one clean block of text may fail to flag it, and the email lands in the inbox looking legitimate, raising the odds someone clicks through and hands over financial or login information.

Microsoft observed a phishing campaign abusing invisible Unicode 'tag' characters, a technique sometimes called ASCII smuggling, inside finance-themed lure emails. Rather than hiding a full hidden instruction (as seen in AI prompt-injection abuse of the same characters), attackers embedded single invisible characters inside common financial keywords, breaking the visible word into different underlying byte sequences without changing what the recipient sees on screen. This can defeat keyword, signature, and tokenization-based filters, including some machine-learning classifiers that split text into pieces before scoring it.

References

View Original Source