Phishing campaign used invisible Unicode to dodge spam filters

Microsoft published a teardown on September 3 of a phishing campaign that hid characters from the Unicode Tags block, U+E0000 to U+E007F, inside financial keywords. Splitting "funding" with an invisible TAG SPACE character (U+E0020) leaves the word readable to a human but broken to a literal signature match or a tokenizer trained on the whole word.

The scale is what makes this more than a curiosity. Message volume went from about 21,000 a day to over 1.3 million on February 9, then peaked at 2.3 million on February 11. The campaign ran weekdays only for roughly three months, across about 150 finance-themed sender domains, and used ActiveCampaign to build up authentication reputation before it stopped on May 15.

The technique isn't new. It surfaced first as a way to smuggle hidden instructions past AI models reading text, and Microsoft's write-up frames this campaign as that same trick crossing over into ordinary phishing evasion. The Unicode Tags block was built for language tagging, not payload hiding, and most rendering and scanning pipelines never expected to see it in a subject line.

Microsoft's guidance, per its security blog post, is to strip or normalize that character range from subject and body text before running content signatures, and before feeding the text to an AI model at all. Treating the mere presence of tag-block characters as an anomaly signal is the second half of that advice.

Anyone building a tool that pipes email, tickets, or scraped web text into an LLM has the same gap this campaign exploited. Sanitizing that Unicode range is what needs to happen before parsing, not something to bolt on after.