Microsoft warns of Unicode‑based phishing surge that slips past filters

Microsoft has issued a warning about a large‑scale phishing operation that is exploiting invisible Unicode tag characters to dodge standard email security measures. The campaign, described by the company as "high‑volume," is distributing millions of malicious messages that conceal malicious content by inserting zero‑width characters into the body of the email.

Unlike typical uses of these characters—often employed to hide instructions from human readers while remaining visible to AI models—the attackers are using them to fragment a financial lure within the same message. By breaking up the bait text with non‑displaying characters, the phishing emails can pass through filters that rely on keyword detection, increasing the likelihood that the messages reach unsuspecting recipients.

The technique takes advantage of the fact that many email scanners treat Unicode tag characters as benign formatting symbols. When the hidden characters are removed or ignored, the concealed link or attachment appears as a legitimate part of the email, prompting users to click or download. This method represents a refinement of older phishing tactics that relied on simple obfuscation or URL shorteners.

Security experts note that the use of Unicode for evasion is not new, but the scale and consistency observed in this campaign suggest a more organized effort. The attacks appear to target both individual consumers and business users, often masquerading as invoices, payment confirmations, or other financially related communications that tend to elicit quick action.

Microsoft advises administrators to update their email filtering rules to strip or normalize invisible Unicode characters before content analysis. Users are also urged to scrutinize any unexpected financial requests, hover over links to view actual URLs, and verify the authenticity of senders through secondary channels.

The incident underscores the ongoing arms race between cybercriminals and security vendors, as attackers continually adopt more sophisticated encoding tricks to bypass defenses. Industry observers expect that email providers will soon roll out additional heuristics and machine‑learning models designed to detect anomalous character patterns, aiming to curb the effectiveness of such Unicode‑based phishing campaigns.