ASCII smuggling crosses over from AI prompt injection to phishing evasion | Microsoft Security Blog

What Happened

Attackers sent millions of fake business loan emails per day using a trick originally developed to hide instructions from AI systems. They inserted invisible characters inside common financial words like 'funding' so that automated email filters could not recognize the words, while human readers saw normal text. The emails were sent through a legitimate email marketing platform called ActiveCampaign, which made them look more trustworthy to spam filters. The campaign ran from February to May 2026, targeting people with fake offers of business loans and credit lines. Organizations should check whether their email security systems properly handle these invisible Unicode characters before scanning message content, and treat the presence of such characters in email as a suspicious signal.

Key Takeaways

• A high-volume phishing campaign repurposed ASCII smuggling (Unicode tag characters U+E0000-U+E007F) from AI prompt injection to traditional phishing filter evasion by splicing invisible characters inside financial keywords.
• Campaign volume peaked at 2.37 million messages per day on February 26, 2026, with a strict weekday-on/weekend-off cadence persisting for approximately three months before dropping sharply after May 15, 2026.
• Approximately 150 disposable finance-themed sender domains were used, all constructed from a small vocabulary of 28 word-tokens recombined into rotating domains.
• Mail was relayed through the legitimate ActiveCampaign email-marketing platform, leveraging its IP reputation and click-tracking infrastructure to complicate reputation-based filtering.
• Defenders should verify that their email normalization and tokenization pipelines strip or fold Unicode tag-block characters before applying content signatures, as this range is rarely seen in legitimate mail outside subdivision flag emojis.

Affected Systems

• Email security gateways and filtering pipelines that perform keyword or regex matching on raw email content
• ML/NLP-based spam and phishing classifiers that tokenize email body text without normalizing invisible Unicode characters
• AI assistants that ingest raw email content and may process hidden Unicode tag characters as instructions

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: Bulk financial-lure phishing emails (business loan, line-of-credit, advance-funding offers) sent from disposable finance-themed sender domains
2. Defense Evasion: Invisible Unicode tag characters (U+E0020) spliced inside high-signal keywords to break signature matching and alter ML tokenization
3. Infrastructure: Emails relayed through legitimate ActiveCampaign email-marketing platform to leverage its IP reputation and authentication
4. Delivery: Links in message body rewritten through platform click-tracking domains (acemlnd.com, activehosted.com) to obscure destination
5. Target: Recipients directed to credential-harvesting or fraud funnels via tracking-redirect links

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: Yes
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No
• Platforms: Microsoft Defender for Office 365 Advanced Hunting (KQL)

The article provides three KQL queries for Microsoft Defender for Office 365 Advanced Hunting. Query 1 hunts by finance-vocabulary sender domains combined with ActiveCampaign envelope patterns. Query 2 pivots on platform tracking URLs joined to email events. Query 3 filters for emails flagged by Prompt Injection Protection detection methods.

Detection Engineering Assessment

Required Log Sources

• Email gateway/mail flow logs with sender domain, envelope sender (MAIL FROM), and sender IP
• Email security platform logs with content scanning and detection verdicts
• URL/click-tracking logs showing redirect destinations
• DNS resolution logs for finance-themed disposable domains

Hunting Hypotheses

Control Gaps

• Email security pipelines that perform keyword or regex matching on raw email content without first normalizing invisible Unicode characters will fail to detect obfuscated lure words.
• ML/NLP-based classifiers that tokenize email body text without stripping Unicode tag-block characters may produce unfamiliar or unknown sub-tokens, degrading classification accuracy.
• Reputation-based filtering may be circumvented when mail originates from a legitimate email-marketing platform with established IP reputation and authentication.
• Email security platforms that rely on OCR-free text extraction may not detect content that appears normal visually but contains invisible character insertions at the byte level.

Key Behavioral Indicators

• Presence of Unicode tag-block characters (U+E0000-U+E007F) in email subject or body, excluding subdivision flag emoji sequences
• Sender header domain constructed from three or more adjacent finance-vocabulary tokens (capital, funding, loan, loc, lend, finance, business, express, growth, etc.)
• Envelope (MAIL FROM) sender matching pattern em-<digits>.<brand-domain> or shared pool subdomains acems<N>.com / emsd<N>.com
• Click-tracking URLs pointing to activehosted.com or acemlnd.com subdomains combined with finance-themed header sender domains
• Strict weekday-on/weekend-off sending cadence from newly registered finance-themed domains
• High volume of inbound mail from a single /24 network block (173.236.20.0/24) combined with finance-themed sender domains

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Consider implementing a Unicode normalization step in your email filtering pipeline that strips or folds invisible and non-rendering code points (including U+E0000-U+E007F, zero-width spaces U+200B, zero-width non-joiners, no-break spaces U+00A0, and soft hyphens) before applying keyword, signature, or regex logic.
• If applicable, evaluate whether your email gateway can apply OCR-based content extraction as a supplementary analysis layer to detect visually normal text that contains invisible character insertions.
• Consider implementing sender domain age and registration patterns as a reputation signal, as this campaign relied on freshly registered disposable domains constructed from a small vocabulary.

User Protection

• Consider deploying email security awareness messaging that highlights finance-themed phishing lures (business loans, lines of credit, advance funding) delivered through legitimate marketing platforms.
• If your organization uses ActiveCampaign or similar email-marketing platforms for outbound communications, consider reviewing account security and abuse-prevention controls to prevent reputation laundering through your infrastructure.

Security Awareness

• Consider incorporating into existing phishing awareness training a note that attackers may use invisible characters to hide content from automated filters while presenting normal-looking text to recipients.
• Where supported by your awareness program, remind users to verify the actual destination URL before clicking links in unsolicited financial offer emails, as links may be rewritten through legitimate tracking domains that obscure the final destination.

MITRE ATT&CK Mapping

Additional IOCs

• Domains:
  • catalystcapitalharbor[.]com - Disposable finance-themed phishing sender domain; 21,130 hits on Feb 9, 2026.
  • rocketboostfunding[.]com - Disposable finance-themed phishing sender domain; 20,908 hits on Feb 9, 2026.
  • digitalrushcapital[.]com - Disposable finance-themed phishing sender domain; 20,796 hits on Feb 9, 2026.
  • guardianloccapital[.]com - Disposable finance-themed phishing sender domain; 20,781 hits on Feb 9, 2026.
  • guardianlocchoice[.]com - Disposable finance-themed phishing sender domain; 20,553 hits on Feb 9, 2026.
  • ourbusinessloans[.]com - Disposable finance-themed phishing sender domain; 20,444 hits on Feb 9, 2026.
  • directcapitalpulse[.]com - Disposable finance-themed phishing sender domain; 19,767 hits on Feb 9, 2026.
  • catalystboostfunding[.]com - Disposable finance-themed phishing sender domain; 19,519 hits on Feb 9, 2026.
  • elevatecapitalrush[.]com - Disposable finance-themed phishing sender domain; 19,395 hits on Feb 9, 2026.
  • fundingexpresscapital[.]com - Disposable finance-themed phishing sender domain; 18,695 hits on Feb 9, 2026.
• Other:
  • U+E0020 - Unicode TAG SPACE character inserted inside financial keywords (e.g., between letters of 'funding') to break literal string matching and alter ML tokenizer output. Primary content-based indicator for this campaign phase.
  • U+E0000-U+E007F - Unicode Tags block range abused for ASCII smuggling. Presence in email subject/body outside known legitimate uses (England/Scotland/Wales flag emojis) is a high-confidence anomaly signal.
  • em-<digits>.<brand-domain> - Envelope (P1) sender pattern used by the campaign via ActiveCampaign platform. Per-account subdomains where a small set of reused account numbers fans out across hundreds of brand domains.
  • acems<N>.com / emsd<N>.com - ActiveCampaign shared sending pool envelope pattern (e.g., emsd4.com, s9.acems10.com). ~98.5% of campaign messages matched this envelope pattern.