Malware Illustrative image generated with AI Microsoft has reported a high-volume phishing campaign that inserts invisible Unicode characters into lure keywords. The goal is to break up the strings searched for by antispam systems without changing what recipients see on screen. The operation emerged in early February 2026 and peaked on February 26, 2026. On weekdays, daily volumes were estimated at between one and 2.37 million messages. After roughly three months of intense activity, traffic dropped sharply after May 15, 2026. This is not a traditional software vulnerability. There are no associated CVEs, CVSS scores, vulnerable versions, or updates to install. Instead, the campaign exploits differences in how interfaces, parsers, and security tools process Unicode text. Words that look normal to people but fragmented to filters The technique is described as a form of ASCII smuggling . The operators insert Unicode code points that many interfaces do not display, creating a mismatch between the visible representation and the content actually analyzed. The abused block is Unicode Tags , which spans U+E0000 to U+E007F . It contains “shadow” equivalents for various ASCII characters: U+E0041 , for example, corresponds to the uppercase letter “A,” while U+E0061 represents the lowercase “a.” The block was designed for language tagging and is now largely deprecated. In this campaign, these characters are inserted into words related to loans and financing. A string such as funding can be constructed conceptually as: fun<U+E0020>ding The code point inserted between the two portions may remain invisible in the email interface. The recipient therefore continues to read “funding,” while a rule looking for the contiguous ASCII sequence may fail to detect it. The issue primarily affects checks based on literal matches or regular expressions that do not account for non-rendered characters. At the code-point level, the word is no longer a continuous sequence. The underlying encoding also contains additional data between the expected letters. Systems do not all handle these characters in the same way. Some remove or ignore tags during rendering; others preserve the entire sequence. This inconsistency allows attackers to display apparently normal text while altering the input received by detection engines. Millions of emails sent on a normal business schedule The campaign’s activity shows a pronounced weekly pattern. Sending was heavy on weekdays, nearly stopped over the weekend, and resumed on Monday. Volumes ranged from one to 2.37 million messages per day , with the peak recorded on February 26, 2026. The scale sets this operation apart from earlier experimental attempts involving invisible characters, homoglyphs, or other forms of Unicode manipulation. The lures imitated offers for: business loans; lines of credit; advance funding. The potential impact extends beyond a recipient clicking a single fraudulent email. Pages reached through these messages can be used to collect credentials, business information, and financial data. These details can then support more precise spear-phishing campaigns. The presence of financial terms split with Unicode also reduces the effectiveness of static rules. A filter that searches only for words such as “funding,” “loan,” or “credit” in their ASCII form may fail to recognize visually identical variants. ActiveCampaign used as forwarding infrastructure The messages were routed through ActiveCampaign , a legitimate marketing and automation platform. Links in the emails also passed through domains used by the service for click tracking: acemlnd[.]com activehosted[.]com Using a well-known provider gives attackers a reputational advantage. Traffic may originate from infrastructure with established authentication and IP reputation, making it resemble a normal commercial campaign. This does not make every message or link associated with ActiveCampaign domains malicious. These are shared services used by legitimate customers as well. Indicators should therefore be correlated with the email content, destination domains, the age of sending domains, and the anomalous presence of Unicode characters. ActiveCampaign said it had tested its moderation systems using messages containing invisible characters. According to the company, obfuscated versions receive the same verdict as their unmodified counterparts, while extensive use of these code points is also treated as suspicious. The campaign used hundreds of disposable sender domains with names related to credit and finance. The domains recording the highest number of visits included: guardiangrowthfunding[.]com digitalcapitalboost[.]com thebusinessloanexpress[.]com yourlocfunding[.]com advancefundingboost[.]com guardiancapitalway[.]com harboradvancefunding[.]com unitedfundingwave[.]com directcapitalboost[.]com onlinedirectfinance[.]com These domains can be used as threat-hunting indicators, but should not be treated in isolation as sufficient signatur...