[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgWqmznxSC1m1-8El95hse0IU7Ce78lp0GJAQfLX6bZ4":3},{"article":4,"iocs":48,"watch_terms":59,"solutions":60,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"ac28e317-f337-42bb-a48b-79cfccf0f877","Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters","phishing-campaign-sends-millions-of-emails-using-invisible-unicode-to-evade-filt-ffe72a","Microsoft is alerting of a \"high-volume phishing campaign\" that's using invisible Unicode tag characters to bypass email filters. \"Instead of using these characters to hide instructions from people while exposing them to AI models, the attacker used them to split financial lure words such as 'funding' to prevent email filters from parsing them,\" the Microsoft Security Research team said. The","A high-volume phishing campaign is using invisible Unicode tag characters to split financial lure words, evading email filters. This technique, known as ASCII smuggling, was observed in millions of emails between February and May 2026, often targeting SBA loan applicants with AI-generated phishing content distributed via ActiveCampaign.","Phishing campaign uses invisible Unicode characters to bypass email filters.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fphishing-campaign-sends-millions-of.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjoD4eMYuhLT8HvcHbYe8A4hkhmDH1f4pIWTIm5AXKueqdpY1NS8yNiTtlzS4mdIS8PLY8_zM1uQDNpO1U49HCUoJT8nn2Bpb6krpcYpOSQ3H3Z6fUsm-UkoFvj8fk8oShK0eUhO6px8hox_ZzlnX8tu0pJKpJ3UAF2Vcb3XyBXjCt_8uD8OOkMMgUjv8Pc\u002Fs1600\u002Femails.jpg","2026-09-04T15:57:15+00:00","2026-09-04T18:00:24.891733+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"ActiveCampaign","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":25},"Unicode","technology",{"name":27,"type":25},"AI",{"name":29,"type":25},"ASCII smuggling","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},[49,53,56],{"type":50,"value":51,"context":52},"mitre_attack","T1041","Exfiltration Over C2 Channel (used for ASCII smuggling to bypass filters)",{"type":50,"value":54,"context":55},"T1566.002","Phishing: Spearphishing Attachment (implied by targeting loan applicants)",{"type":50,"value":57,"context":58},"T1566.001","Phishing: Spearphishing Link (implied by distributing via ActiveCampaign)",[21,18],{"controls":61,"vendors":144},[62,90,118],{"slug":40,"name":63,"problem":64,"products":65},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"slug":91,"name":92,"problem":93,"products":94},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":112,"vendor_name":21,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"slug":119,"name":120,"problem":121,"products":122},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[123,131,138],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":119,"product_name":135,"url":136,"description":137},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":139,"product_name":140,"url":142,"description":143},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[145],{"slug":112,"name":21,"logo_path":113,"roles":146},[147],"reported_by",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":163},"invisible-unicode-characters-used-to-bypass-email-filters-in-mass-phishing-campaign","Invisible Unicode Characters Used to Bypass Email Filters in Mass Phishing Campaign","Attackers exploited invisible Unicode tag characters (ASCII smuggling) to split financial keywords, causing traditional email security filters to fail to detect phishing content that humans can still read normally. This campaign targeted millions of recipients — including SBA loan applicants — using AI-generated lure content delivered through a legitimate email marketing platform (ActiveCampaign), making the emails appear credible and bypassing reputation-based defenses. The abuse of a trusted third-party sending infrastructure highlights how attackers weaponize legitimate services to evade detection. This matters because it demonstrates that signature-based and keyword-matching email filters alone are insufficient against evasive encoding techniques, leaving organizations dangerously exposed.",[153,154,155,156,157,158,159,160,161,162],"CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 8 – Audit Log Management","NIST SP 800-177 – Trustworthy Email","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AT-2 – Security Awareness Training","NIST SP 800-53 SC-7 – Boundary Protection","GDPR Article 32 – Security of Processing (organizational measures)","MITRE ATT&CK T1566.001 – Phishing: Spearphishing Attachment","MITRE ATT&CK T1027 – Obfuscated Files or Information",{}]