Phishing gang hides invisible characters inside emails to slip past filters

Key points

• Microsoft's Security Research team has warned of a high-volume phishing campaign using invisible Unicode tag characters to slip past email filters.
• The attackers hide the characters inside financial bait words such as "funding" so scanning tools fail to recognise the words as suspicious.
• The trick abuses Unicode Tags, a rarely-used block of characters (U+E0000 to U+E007F) that most software renders as nothing at all.
• Microsoft says human readers still see a normal-looking email, so the lure works even though the underlying text is scrambled.
• Defenders are advised to strip or flag Unicode tag characters at the email gateway and to keep training staff to double-check finance-themed messages.

Microsoft has flagged a large phishing campaign that hides invisible characters inside emails to fool the software that is meant to catch them.

Phishing, for readers new to the term, is when criminals send fake messages that look like they come from a bank, a boss or a supplier, hoping the reader clicks a link or hands over a password.

The new twist, described by Microsoft's Security Research team, is how the emails are built. Words that would normally set off alarm bells at the mail server, things like "funding" or "payment", have been chopped up with hidden characters. A human still reads "funding" on screen. The filter sees gibberish and waves it through.

What are these invisible characters?

They are called Unicode tag characters. Unicode is the giant global alphabet that lets computers show every language, emoji and symbol. Tucked inside it is a small block of codes (U+E0000 to U+E007F) that render as nothing visible. They were designed years ago for language tagging and were later mostly abandoned.

Attackers have rediscovered them. Drop one between the "f" and "u" of "funding" and the word looks fine to a person but reads as "f[nothing]unding" to a scanner that checks for finance-related lures.

How is this campaign different?

Invisible-character tricks have shown up before, usually aimed at confusing AI assistants that read hidden instructions inside a document. This campaign, first flagged by Microsoft and reported by The Hacker News, flips the idea around. The hidden characters are not there to talk to an AI. They are there to break up words so ordinary email filters cannot spot the scam.

Microsoft describes the volume as high, meaning millions of messages, not a targeted handful. The lures lean on money themes: fake funding notices, invoices, payment confirmations. Classic bait, dressed up in a new disguise.

Should ordinary people be worried?

Mostly this matters to the people who run email systems, but a bit of caution helps everyone. Any unexpected email about money, especially one that pushes you to click a link or open an attachment, deserves a slow second look. If it claims to come from your bank, your employer's finance team or a supplier, contact them through a number or address you already trust, not the one in the email.

The emails themselves will look normal. That is the whole point of the trick. So the usual advice still holds: hover over links before clicking, check the sender address carefully, and treat urgency as a red flag rather than a reason to hurry.

What defenders should do

Microsoft has not named a specific group behind the campaign. The company is telling defenders to update filtering rules to treat the tag block as suspicious by default.