Spammers Deploy ASCII Smuggling in Massive Phishing Campaign Hitting 2.37 Million Daily Emails

Spammers Adopt AI Attack Technique for Email Evasion

A massive phishing campaign leveraging ASCII smuggling techniques sent up to 2.37 million emails daily at its peak, marking a significant evolution in how cybercrime adapts AI-related security threat methods for traditional spam operations1

1

. Microsoft researchers Noam Kochavi and Sarah Wolstencroft discovered the operation in early February 2026, when detection signatures for invisible Unicode characters suddenly spiked from roughly 21,000 messages on February 8 to more than 1.3 million the following day2

2

. The campaign maintained weekday volumes between 1 and 2.37 million messages for approximately three months before dropping sharply after May 15, 20263

3

.

ASCII smuggling gained prominence two years ago as a method to conceal malicious instructions in AI prompt injection attacks. The technique exploits the Unicode Tags block (U+E0000-U+E007F), which contains invisible shadow copies of printable ASCII characters that computers can read but humans cannot see4

4

. While originally designed for language tagging and later abandoned by Unicode, these characters became valuable for hiding prompts from users while exposing them to large language models. Attackers would embed instructions in emails or documents using tags like U+E0041 to mirror "A" and U+E0061 to mirror "a," enabling AI assistants to execute unauthorized actions without user awareness1

1

.

Finance-Themed Domains Target Business Funding Seekers

The phishing campaign operated through approximately 150 finance-themed sender domains, with 148 identified on February 9 alone accounting for roughly 96% of flagged messages3

3

. These domains incorporated terms like "funding," "capital," "loan," "advance," and "credit" to target small business owners seeking financial services. The top-performing sender domains included guardiangrowthfunding[.]com, digitalcapitalboost[.]com, thebusinessloanexpress[.]com, yourlocfunding[.]com, and advancefundingboost[.]com4

4

.

Instead of hiding AI instructions, attackers inserted invisible Unicode tag spaces between letters to split financial keywords and evade keyword-matching filters. A word like "funding" became "fun⟨U+E0020⟩ding," appearing normal to recipients while defeating literal string matches that spam filters rely upon2

2

. This approach targets both traditional detection systems and modern machine learning classifiers that tokenize text before analysis. When natural language processing systems split text into tokens or sub-word pieces, the inserted invisible character can fragment familiar tokens into rare or unknown sequences, disrupting pattern recognition1

1

.

Campaign Infrastructure and Behavioral Patterns

The operation demonstrated distinctive characteristics that revealed its automated nature. Messages followed a strict weekday-on, weekend-off schedule, with traffic collapsing to near zero every Sunday and resuming full volume on Mondays5

5

. This rhythm indicates scheduled bulk-sending infrastructure rather than manual operation. After an intense first phase peaking on February 26, weekday volumes gradually declined by roughly 80% by late March before the sharp drop in mid-May2

2

.

Messages were delivered through infrastructure associated with ActiveCampaign, a legitimate email marketing and automation platform. The broader campaign weaponized ActiveCampaign's AI-powered features to mass-produce convincing, tailored websites that adapt to different illegitimate domains, targeting Small Business Administration (SBA) loan applicants4

4

. Every outbound link in message bodies was routed through ActiveCampaign's click-tracking domains. After Microsoft reported the service abuse, ActiveCampaign stated its moderation systems detect invisible Unicode characters the same way they detect unobfuscated text and treat heavy use as suspicious3

3

.

Detection Success and Defensive Implications

Despite the campaign's scale and sophistication, Microsoft Defender for Office 365 caught over 99% of the messages based on signals unrelated to the invisible characters themselves3

3

. Sender and IP reputation checks, URL and domain analysis, brand impersonation detection, authentication protocols, and machine learning classifiers all flagged the messages. Defender's approach of photographing message content and performing OCR extraction over the visual image proved particularly effective, as it sees exactly what human recipients see1

1

.

The evasion technique ironically became a detection indicator. Tag characters are so rare in legitimate email that their presence now serves as a high-confidence campaign indicator5

5

. Microsoft's signature had only one false-positive issue: legitimate mail containing flags of England, Scotland, and Wales, which are built from invisible tag characters. The sudden spike of tag-block characters concentrated on finance-themed senders, switching on and off weekly, provides defenders with a distinctive behavioral pattern to monitor2

2

.

Recommendations for Strengthening Email Security

Microsoft advises defenders to verify that Unicode normalization and tokenization pipelines handle tag characters consistently. Any content evaluated by keyword, signature, or regex logic should first have invisible and non-rendering Unicode code points stripped or folded, preventing attackers from bypassing modern spam detection systems by splicing them into words2

2

. This same control helps reduce threats from ASCII smuggling against AI assistants that ingest email content, addressing both traditional phishing and AI prompt injection attacks simultaneously3

3

.

The campaign illustrates how AI-era attack methods can be adapted for use in traditional threats like phishing and spam, reinforcing the need for defenders to view emerging threats through a cross-domain lens. While spammers have used zero-width spaces and non-breaking spaces for decades to achieve similar obfuscation, the adoption of Unicode tag characters represents an attempt to bypass defenses that hadn't yet been programmed to detect them1

1

. Organizations should implement behavioral monitoring for sudden spikes in tag-block usage and maintain robust multi-layered detection that doesn't rely solely on content analysis to protect against evolving spear-phishing techniques.