Attackers conceal phishing lures using invisible Unicode characters

Threat actors use invisible Unicode characters (ASCII smuggling) to hide phishing lures and evade email security filters.

Threat actors have adopted the ASCII smuggling technique in phishing campaigns, embedding invisible Unicode characters in emails to conceal malicious lures. The approach is designed to evade email security filters that scan for visible phishing indicators. The report gives no victim counts or named campaigns.

• Attackers embed invisible Unicode characters to conceal phishing content from filters.
• ASCII smuggling adoption signals a growing email-evasion trend.