Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters
Microsoft warns of a high-volume phishing campaign using invisible Unicode characters to split keywords like 'funding' and evade filters, peaking at 2.37 million daily messages.
Microsoft's Security Research team documented a high-volume phishing operation inserting deprecated Unicode Tags characters (U+E0000-U+E007F) inside financial keywords such as 'funding' so literal-string and regex email filters stop matching them. The campaign ran on a weekly cadence with 1-2.37 million weekday messages between February and May 15, 2026, peaking on February 26, 2026. It used hundreds of disposable finance-themed sender domains and relayed mail through ActiveCampaign's click-tracking infrastructure (acemlnd[.]com, activehosted[.]com), lending legitimate platform reputation. Microsoft ties the activity to an AI-assisted SBA loan phishing campaign that Fortra's FIRE team disclosed in September 2025.
- Attackers insert invisible U+E0000-U+E007F tag characters inside financial keywords to defeat literal string and regex email filters.
- Weekday volume reached 1-2.37 million messages, with high-volume activity from February to May 15, 2026.
- Relaying via ActiveCampaign click-tracking domains gives emails reputable sending infrastructure, complicating reputation-based filtering.
- Microsoft links the activity to an SBA loan phishing operation using AI-generated tailored websites, disclosed by Fortra in 2025.
- Products
- ActiveCampaign
- Organizations
- Fortra FIRE
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | acemlnd.com | sage body to be routed via its own click-tracking domains ("acemlnd[.]com" and "activehosted[.]com"). ActiveCampaign, for its part, |
| domain | activehosted.com | ed via its own click-tracking domains ("acemlnd[.]com" and "activehosted[.]com"). ActiveCampaign, for its part, said it has tested its c |
| domain | advancefundingboost.com | ost[.]com thebusinessloanexpress[.]com yourlocfunding[.]com advancefundingboost[.]com guardiancapitalway[.]com harboradvancefunding[.]com unite |
| domain | digitalcapitalboost.com | he most hits are listed below - guardiangrowthfunding[.]com digitalcapitalboost[.]com thebusinessloanexpress[.]com yourlocfunding[.]com advance |
| domain | directcapitalboost.com | ay[.]com harboradvancefunding[.]com unitedfundingwave[.]com directcapitalboost[.]com onlinedirectfinance[.]com What's more, these emails from |
| domain | guardiancapitalway.com | xpress[.]com yourlocfunding[.]com advancefundingboost[.]com guardiancapitalway[.]com harboradvancefunding[.]com unitedfundingwave[.]com direct |
| domain | guardiangrowthfunding.com | e top 10 sender domains by the most hits are listed below - guardiangrowthfunding[.]com digitalcapitalboost[.]com thebusinessloanexpress[.]com yo |
| domain | harboradvancefunding.com | ng[.]com advancefundingboost[.]com guardiancapitalway[.]com harboradvancefunding[.]com unitedfundingwave[.]com directcapitalboost[.]com onlinedi |
| domain | onlinedirectfinance.com | ding[.]com unitedfundingwave[.]com directcapitalboost[.]com onlinedirectfinance[.]com What's more, these emails from these finance-themed domai |
| domain | thebusinessloanexpress.com | low - guardiangrowthfunding[.]com digitalcapitalboost[.]com thebusinessloanexpress[.]com yourlocfunding[.]com advancefundingboost[.]com guardianca |
| domain | unitedfundingwave.com | t[.]com guardiancapitalway[.]com harboradvancefunding[.]com unitedfundingwave[.]com directcapitalboost[.]com onlinedirectfinance[.]com What's |
| domain | yourlocfunding.com | ]com digitalcapitalboost[.]com thebusinessloanexpress[.]com yourlocfunding[.]com advancefundingboost[.]com guardiancapitalway[.]com harbor |
From the original article
4 min read at thehackernews.com
Microsoft is alerting of a "high-volume phishing campaign" that's using invisible Unicode tag characters to bypass email filters. "Instead of using these characters to hide instructions from people while exposing them to AI models, the attacker used them to split financial lure words such as 'funding' to prevent email filters from parsing them," the Microsoft Security Research team said. The
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.