Unicode Tag Characters Powered 2.37M Daily Phishing Emails in ActiveCampaign SBA Campaign
Microsoft tied a multi-million-email phishing wave to an ActiveCampaign SBA operation that adopted Unicode tag obfuscation to evade filters. The technique, drawn from AI prompt-injection methods, exposed gaps in current normalization logic. Updated preprocessing is required before similar evasion spreads further.
Microsoft Security Research traced the messages to a prior Fortra FIRE operation that had already weaponized ActiveCampaign automation to generate tailored SBA-loan phishing sites. The same infrastructure simply added Unicode tag interleaving to defeat literal-string and simple-regex detectors while the rendered text remained readable to recipients.
The U+E0020 tag, for example, splits “funding” into non-contiguous code points; filters that drop rather than normalize these characters still see the intended word, but detectors expecting contiguous ASCII do not. Peak volume occurred on 26 February before the campaign abruptly throttled after mid-May, maintaining a strict Monday-to-Friday cadence.
This marks the first large-scale transfer of ASCII-smuggling techniques—previously discussed in prompt-injection research—into conventional spam pipelines. Small-business recipients, already primed by the earlier ActiveCampaign wave, faced elevated risk of follow-on spear-phishing once financial details were harvested.
Email gateways must now enforce complete Unicode-tag stripping and normalization before keyword inspection; vendors that delay this change will continue to see measurable bypass rates on financial lures.
Microsoft: Major gateways implementing full U+E0000-U+E007F stripping will see >60% drop in this evasion class within 90 days of rollout.
Sources (2)
- [1]Microsoft Security Research(https://www.microsoft.com/security/blog/2026/09/unicode-phishing)
- [2]Fortra FIRE ActiveCampaign Report(https://www.fortra.com/intelligence/reports/activecampaign-phishing-2025)