Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters

Microsoft is alerting of a "high-volume phishing campaign" that's using invisible Unicode tag characters to bypass email filters. "Instead of using these characters to hide instructions from people while exposing them to AI models, the attacker used them to split financial lure words such as 'funding' to prevent email filters from parsing them," the Microsoft Security Research team said. The

Fact: Microsoft reports a high-volume phishing campaign that uses invisible Unicode tag characters to split key financial lure words (e.g., “funding”) so that email filters fail to recognize them, allowing millions of phishing emails to evade detection. Fact: The technique manipulates text representation without overtly visible changes to human readers, targeting weaknesses in automated filtering and detection pipelines. RealGround analysis: While the article focuses on email security, the same Unicode obfuscation patterns can be used to bypass AI-based detection systems and to craft harder-to-detect malicious content in enterprise environments. Practical implication: Organizations should treat Unicode and text-obfuscation tricks as part of their AI threat model, updating detection pipelines and red-teaming exercises to ensure email filters and AI-driven classifiers correctly normalize and inspect such content.