[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBySVj-JIXD_p_BDdsu_Ob60AyenBLgic_gIODC7OttQ":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"f089dab1-4a48-4c8b-8ffa-9dfedd68a1ef","Attackers conceal phishing lures using invisible Unicode characters","attackers-conceal-phishing-lures-using-invisible-unicode-characters-bc441f","Threat actors have adopted the ASCII smuggling technique in phishing campaigns, using invisible Unicode characters to evade email security filters. [...]","Threat actors are employing an ASCII smuggling technique, inserting invisible Unicode characters into finance-related keywords to evade email security filters. Microsoft observed a large-scale phishing campaign utilizing this method, which peaked at over 2.37 million daily messages. While Defender blocked over 99% of these messages through other detection signals, Microsoft recommends normalizing Unicode characters before applying keyword-based detections to mitigate such threats.","Attackers use invisible Unicode characters to bypass email security filters in phishing campaigns.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fattackers-conceal-phishing-lures-using-invisible-unicode-characters\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F05\u002F13\u002FPhishing.jpg","2026-09-06T14:23:46+00:00","2026-09-06T16:00:08.445357+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Defender for Office 365","product",{"name":21,"type":22},"Unicode","technology",{"name":24,"type":22},"ASCII smuggling",{"name":26,"type":22},"AI prompt injection",{"name":28,"type":19},"ActiveCampaign",{"name":30,"type":22},"ActiveCampaign email-marketing platform","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},[],[18,28],{"controls":52,"vendors":132},[53,80,106],{"slug":54,"name":55,"problem":56,"products":57},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[58,64,72],{"vendor_slug":59,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":59,"url":62,"description":63},"dmarcian","\u002Fvendor-logos\u002Fdmarcian.png","dmarcian-platform","https:\u002F\u002Fdmarcian.com\u002F","DMARC report processing and guidance for moving domains to enforcement.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"red-sift","Red Sift","\u002Fvendor-logos\u002Fred-sift.png","ondmarc","Red Sift OnDMARC","https:\u002F\u002Fredsift.com\u002Fpulse-platform\u002Fondmarc","Guided DMARC deployment and monitoring, with support for BIMI and MTA-STS.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","email-fraud-defense","Proofpoint Email Fraud Defense","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-fraud-defense","DMARC deployment and monitoring with hosted SPF and DKIM services.",{"slug":81,"name":82,"problem":83,"products":84},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[85,90,98],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":86,"product_name":87,"url":88,"description":89},"core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"slug":107,"name":108,"problem":109,"products":110},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[111,118,124],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":107,"product_name":115,"url":116,"description":117},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":119,"product_name":120,"url":122,"description":123},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[133],{"slug":134,"name":135,"logo_path":136,"roles":137},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[138],"reported_by",{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":153},"invisible-unicode-characters-used-to-bypass-email-security-filters","Invisible Unicode Characters Used to Bypass Email Security Filters","Threat actors exploited ASCII smuggling — embedding invisible Unicode characters into finance-related keywords — to evade signature and keyword-based email security filters at scale, reaching over 2.37 million messages per day. The root issue lies in email security configurations that apply keyword detection against raw, un-normalized text, leaving a trivial but effective evasion gap. While Microsoft Defender mitigated over 99% of messages through supplementary signals, organizations relying solely on keyword-based filters would have been significantly exposed. This attack highlights how even well-established defensive controls can be undermined by subtle encoding tricks, and underscores the need for layered, technically robust detection pipelines. End users who receive such emails remain at risk of credential theft or financial fraud if they are not trained to recognize phishing cues beyond obvious keyword triggers.",[144,145,146,147,148,149,150,151,152],"CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-177: Trustworthy Email (Section 4 - Email Authentication)","NIST SP 800-53 SI-8: Spam Protection","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 SC-7: Boundary Protection","MITRE ATT&CK T1566.001: Phishing - Spearphishing Attachment","MITRE ATT&CK T1036: Masquerading (Encoding Evasion)","GDPR Article 32: Security of Processing (for organizations handling personal data exposed via phishing)",{}]