The word in the email said funding. What actually travelled down the wire was fun, then an invisible character, then ding. The recipient could not see the difference. Neither, potentially, could the filter meant to catch the message.
Microsoft researchers say that one trick, lifted from AI prompt injection research, carried a phishing campaign that peaked above 2.3 million messages in a single day.
A deprecated Unicode block gets a second life
The characters come from the Unicode Tags block, U+E0000 to U+E007F, an invisible shadow copy of printable ASCII, built for language tagging and now largely deprecated. Almost no font draws it, and that invisibility is the whole appeal. Over the past year AI red teamers made the block famous under the name ASCII smuggling, using it to hide instructions a person would never see but a language model reading the raw text would obey. It is the same gap between what a human sees and what a model reads that drove the EchoLeak research on Microsoft 365 Copilot.
This campaign inverted the goal. Writing in the original report, Noam Kochavi and Sarah Wolstencroft, with Microsoft Security Research, say the operators smuggled no instructions at all. They dropped a single invisible tag character, U+E0020, into the middle of high signal finance words so a detector hunting the literal string would come up empty. Microsoft is precise about the distinction: this is invisible-character insertion using a code point from the smuggling block, not full message smuggling.
Why breaking a word breaks a classifier
To a reader, and to any pipeline that normalizes these characters away first, the word still reads as funding. To a detector matching the literal string, the keyword is simply no longer there. The larger target, Microsoft argues, is the machine learning models that increasingly do the sorting. A classifier does not reason over whole words the way a person does; it splits text into tokens first. Push an invisible character into the middle and the tokenizer may no longer see a familiar unit, emitting rare or unknown fragments instead.
Found by a hunt for something else entirely
The signature that caught it was built for Microsoft Defender for Office 365 prompt injection protection, looking for email-borne instructions aimed at AI systems. Its first version flagged any code point in the tag range and proved too blunt, firing on legitimate messages that all turned out to carry the England, Scotland or Wales flag emoji, each encoded as a base flag plus an invisible tag sequence.
With those excluded the baseline went quiet, which is what made the spike legible. On February 8, 2026 the signature fired on roughly 21,000 messages. The next day it fired on more than 1.3 million, and it peaked above 2.3 million on February 11. Volume ran hard on weekdays and fell almost silent every weekend, the rhythm of scheduled bulk-sending infrastructure, and the high volume phase held for about three months before dropping sharply after May 15. Roughly 150 disposable, finance-themed sender domains carried it, accounting for about 96% of the flagged volume.
The mail was relayed through infrastructure associated with the marketing platform ActiveCampaign, so recipients clicked tracking domains such as acemlnd[.]com and activehosted[.]com rather than the branded sender, and about 92% of daily volume came from one network block that Microsoft notes belongs to the abused service and is not an indicator on its own. ActiveCampaign, told before publication, said such messages receive the same moderation verdicts as their unobfuscated equivalents.
Test what your own pipeline does with tag characters
The practical question is whether tag characters are normalized or flagged before content detections run, and Microsoft is explicit that implementations vary and teams should test their own. For Defender for Office 365 it says over 99% of these messages were flagged by layers that never depended on the tag characters at all, chiefly reputation, machine learning classification and brand impersonation checks.
There is an upside in the rarity. Legitimate mail almost never carries these code points, so their presence becomes a high confidence signal, and a technique adopted to look more benign to a model hands defenders a low false positive detection instead. Phishing infrastructure adapts fast, as our reporting on a kit that rebuilt itself after an FBI takedown showed. The more durable lesson is narrower: techniques do not stay in the field that invented them, and an idea born in AI red teaming will turn up in a spam run.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.