Microsoft Warns of Phishing Campaign Using Invisible Unicode Tag Characters to Evade Filters

What happened

Microsoft's Security Research team has disclosed a high-volume phishing campaign, reportedly sending millions of emails, that uses invisible Unicode "tag" characters to evade email filtering. According to Microsoft, attackers embedded these hidden characters inside financial lure words — such as splitting "funding" — so that filters parsing the visible text fail to match on the flagged terms, while the word still renders normally to the recipient.

Microsoft notes this is a variation on a technique more commonly associated with hiding instructions from humans while exposing them to AI models; here it's being repurposed purely to break filter string-matching rather than to target AI systems.

Why it matters for defenders

This is a filter-evasion technique, not a new exploit — but at reported million-message scale it suggests an established, well-resourced phishing operation actively probing gaps in mail security stacks. Financial-lure phishing (invoice, funding, and payment-themed emails) is a common precursor to business email compromise and wire fraud, so any organization relying on keyword- or pattern-based email filtering for these lures is potentially exposed regardless of industry or sector.

What defenders should watch for

• Review whether email security/anti-phishing tooling normalizes or strips invisible Unicode tag characters (and other zero-width/invisible code points) before running keyword or lure-word matching.
• Hunt for inbound emails containing Unicode tag block characters (U+E0000–U+E007F) or other non-rendering Unicode sequences interspersed within otherwise readable words, particularly in subject lines and body text.
• Don't rely solely on literal keyword matching for financial lure terms; favor detection logic that normalizes/decodes text before pattern matching, combined with sender reputation, authentication (SPF/DKIM/DMARC), and behavioral signals.
• Flag and investigate a spike in externally-sourced emails referencing funding, invoices, or payment changes, especially where filter logs show no keyword hits despite user reports of suspicious content.

Developing story

Details here are based on Microsoft's initial disclosure and reporting is still developing; specific indicators, targeted sectors, and full technical breakdown of the campaign were not available at the time of writing. For the original report, see The Hacker News.