ASCII smuggling started out as a problem for AI systems: hide invisible Unicode characters inside a block of text, and a large language model reading that text can be steered by instructions no human reviewer would ever see. Microsoft’s research published on September 3 traces the same trick showing up somewhere much older, a spam filter. Attackers running a large-scale phishing operation used invisible Unicode tag characters to split financial lure words in half, defeating keyword and machine-learning filters while leaving the email looking completely normal to anyone reading it.
A Space That Isn’t There
The technique is simple once you see it. Take a word a spam filter is trained to flag, such as “funding,” and insert a character from the Unicode tag block, in the range U+E0000 to U+E007F, in the middle of it. The character renders as nothing. A person opening the email sees “funding,” unbroken and unremarkable. A filter doing literal string matching, or a machine-learning classifier tokenizing the text into words it recognizes, sees two fragments that match nothing in its training data. The lure survives inspection precisely because the filter is looking at a different word than the reader is.
Microsoft says the campaign’s high-volume phase ran from February 9 through May 15, mostly promoting small-business funding, lines of credit, and advance-funding offers. Volume jumped from around 21,000 messages a day to more than 1.3 million within days of the technique going live, and peaked at 2.37 million messages in a single day on February 26. The sending pattern followed a strict weekday schedule with almost nothing on weekends, and roughly 150 finance-themed domains recombined a working vocabulary of just 28 words, terms like guardian, boost, funding, and capital, to keep generating fresh-looking lures.
Borrowed Trust From a Real Marketing Platform
The campaign is tied to a broader operation Fortra’s research team had already flagged: AI-generated phishing sites impersonating the U.S. Small Business Administration’s loan programs, built to harvest detailed business and financial information from applicants rather than push for an immediate click. What made the emails themselves hard to stop was where they came from. The messages were relayed through ActiveCampaign, a legitimate marketing automation platform, using its own tracking domains to rewrite links. That routing did more than hide the final destination. It meant the mail was leaving infrastructure that authenticates cleanly, because it belongs to a real, established sender that mailbox providers already trust.
Why DMARC Had Nothing to Flag
DMARC checks one thing: whether the domain in the From header authorized the infrastructure that sent the message. When that infrastructure is a legitimate ESP’s own mail servers, correctly configured with SPF and DKIM, the answer is yes every time, regardless of what a malicious tenant is doing with the account. DMARC has no concept of a Unicode tag character, no way to inspect whether a word has been fractured for a downstream filter, and no visibility into whether the account sending through that authenticated infrastructure belongs to a business or a phishing operation abusing a free trial. The entire attack lived in the layer DMARC was never built to police: the readable content of an authenticated message, and the reputation of the account using it.
What This Means for Your Program
Do not treat authentication as a proxy for trustworthy content. A message that passes SPF, DKIM, and DMARC because it genuinely came from a major ESP’s infrastructure tells you nothing about what the tenant behind that account is sending.
Push your content filtering past literal keyword matching. Unicode-normalize incoming text before running it through any keyword or classifier stage, so tag characters and other invisible code points cannot fracture the words your filters are trained to catch.
Watch for volume anomalies from ESP-relayed mail, not just unfamiliar domains. A sudden multi-hundred-thousand-message jump routed through a trusted marketing platform is exactly the kind of signal that hides inside a sender’s good reputation.
Treat SBA, loan, and business-funding lures as an active threat right now, especially anything reaching small-business finance or ownership contacts, since this campaign specifically targeted applicants for that kind of credit.
The Takeaway
This campaign did not need a new domain, a spoofed header, or a broken authentication record. It needed one word split apart by a character no reader would ever see, sent through infrastructure that was never going to fail DMARC in the first place. That combination is the real lesson: as attackers keep borrowing techniques built for tricking AI systems, the fight moves further from “did this domain have permission to send” and further into “what is actually inside the words this authenticated sender wrote.”
DMARC confirms a domain had the authority to send a message. It cannot tell you that the words inside that message have been fractured with invisible Unicode characters to slip past your filters, or that the legitimate platform relaying it has a malicious tenant behind the account. Excello Mail turns your DMARC aggregate reports into a clear, continuous record of every domain and service sending as you, so the authentication layer stays airtight while your team watches for the content-level tricks DMARC was never designed to catch. Sign up for free to Excello Mail and get that foundation in place.