Summary
A large-scale phishing campaign exploited invisible Unicode characters to split financial keywords across character boundaries, bypassing email security filters that scan for terms like invoice, payment, and wire transfer. The technique, adapted from ASCII smuggling methods developed for AI prompt injection attacks, inserts zero-width Unicode characters within keywords so that filters see character sequences that do not match their pattern library while the rendered text appears normal to human recipients. The campaign reached a peak volume of 2.37 million messages per day.
Timeline
| Date | Event |
|---|---|
| Sep 6, 2026 | Phishing campaign using invisible Unicode keyword splitting confirmed; 2.37M messages per day peak; Microsoft documents campaign |
What Happened
Email security filters relying on keyword matching are vulnerable to character-level obfuscation that preserves the visual appearance of a word while breaking its character sequence. The technique inserts Unicode characters with zero visual width within financial keywords at positions that prevent pattern matching while leaving the word visually intact. A filter scanning for “invoice” does not match “invoice” even though a human reading the email sees invoice.
The adaptation of this technique from AI prompt injection research is notable. Prompt injection attacks use similar invisible character insertion to embed instructions that are invisible to human reviewers but processed by AI models. The transfer of this technique from AI security research into email security bypass demonstrates the cross-pollination between AI attack research and conventional cybercrime tooling.
Domain Intelligence
microsoft.com — 73.27
microsoft.com scores at 73.27. Microsoft is the security researcher that documented and published analysis of the campaign.