Microsoft detects mass phishing using hidden Unicode tags

Microsoft identified a large phishing campaign that uses hidden Unicode tag characters to disguise key words in emails, enabling attackers to evade spam filters and machine learning-based detection. Microsoft tracked this method, known as ASCII smuggling, in more than 2.3 million messages over two days. While invisible to recipients, these tags break up high-risk words like “credit” or “loan,” allowing them to slip past automated screening systems.

• Attackers inserted invisible Unicode tags into phishing emails
• Over 2.3 million messages detected in two days
• Tags disrupt word detection by spam filters and classifiers
• Recipients only see normal-looking offers for loans and credit
• Standard Unicode normalization tools may not remove these tags