Microsoft researchers identified a widespread financial phishing campaign that repurposed the “ASCII smuggling” technique, known from prompt-injection research involving artificial intelligence models, to confuse email filters rather than hide instructions from users and reveal them to models.
The campaign relied on invisible Unicode characters from the Tags block between U+E0000 and U+E007F. The message appears normal to the recipient, but the attacker inserts an invisible character inside financial terms to split them at the text level. In one case, the word funding appeared with U+E0020 between its two parts, which could prevent a text match searching for the complete word.
A major surge on February 9
Microsoft discovered the activity while developing search logic within Microsoft Defender for Office 365 to detect content that might include prompt injection or text obfuscation in email messages. On February 8, 2026, the detection was triggered approximately 21,000 times, before exceeding 1.3 million messages the following day.
The majority of messages clustered around approximately 150 financially themed sending domains, while the high-volume phase continued for nearly three months after February 9 and declined sharply after May 15, 2026, with limited activity continuing until mid-June. The campaign peaked on February 26, when daily volume on business days ranged between one million and 2.37 million messages. It also followed a clear weekly pattern: heavy activity from Monday through Friday and near-total silence during the weekend.
Obfuscating words, not smuggling a hidden message
Microsoft found no hidden instructions directed at an AI assistant in the samples it examined. Instead, individual Tags characters were used as separators inside words associated with loan offers, lines of credit, and advance financing. This may affect systems that rely on word matching or on splitting text into subunits before classification, although the outcome depends on whether the system normalizes or removes these characters before analysis.
This is not the first time invisible characters have been used to bypass matching; attackers have previously exploited zero-width spaces, visually similar characters, and soft hyphens. What is new here is the use of a Unicode block recently associated with AI security research, on a scale reaching millions of messages per day.
A seemingly legitimate sending infrastructure
The campaign used hundreds of temporary domains built from financial vocabulary, and this pattern accounted for approximately 96% of the messages captured by the search detection. Most messages were sent through the infrastructure of the ActiveCampaign email marketing platform, which rewrote links using the tracking domains acemlnd[.]com and activehosted[.]com.
Microsoft warns against treating these domains or the 173.236.20[.]0/24 address block as standalone malicious indicators, because they are shared infrastructure that may carry legitimate messages for other customers. The company says that more than 99% of the messages were blocked through multiple layers, including sender, domain, and IP address reputation; link analysis; message classification; brand impersonation detection; and authentication checks, rather than through the Unicode detection alone.
Why does this development matter?
The campaign demonstrates that attack methods emerging in the context of AI security can quickly move into traditional phishing. In practice, email systems should normalize text before applying word and regular-expression rules, while treating invisible Unicode characters as an anomaly signal and excluding known legitimate uses such as the flags of England, Scotland, and Wales, which also rely on Tags characters.
Microsoft also recommends applying the same normalization before passing email content to AI systems and using the campaign’s behavioral infrastructure indicators—changing financial domains, business-day sending patterns, envelope-sender format, and tracking links—as cross-corroborating indicators rather than standalone judgments. The effectiveness of these measures remains dependent on how Unicode is processed and on the protection settings and products used in each environment.