Microsoft Researchers Identify New Phishing Tactic Using Invisible Unicode Tags to Evade Filters

REDMOND, Wash. — Microsoft Security Research has identified a sophisticated phishing campaign utilizing invisible Unicode tag characters to fragment financial keywords, allowing malicious emails to bypass standard security filters. The discovery, detailed in a report released on Sept. 3, 2026, highlights an evolving method used by threat actors to target global organizations with high-volume fraudulent messages.

Noam Kochavi and Sarah Wolstencroft of Microsoft's security team observed the technique through telemetry data collected by Microsoft Defender for Office 365. The campaign involves inserting zero-width or invisible Unicode characters between letters in words related to finance, such as "invoice," "payment," or "urgent." By splitting these terms, attackers prevent email filtering systems from recognizing the complete phrases that typically trigger security alerts. To the human recipient, the text appears normal and legible, but to automated defenses, the words are fragmented into non-threatening strings.

The attack vector represents a significant shift in how adversaries attempt to circumvent content-based detection mechanisms. Traditional filters often rely on keyword matching to flag suspicious financial lures. By obscuring these keywords with invisible tags, the campaign successfully evades initial screening processes, allowing phishing emails to reach user inboxes where they can prompt victims to click malicious links or disclose sensitive credentials.

Microsoft researchers noted that the campaign is operating at a high volume across multiple regions, indicating a coordinated effort by threat actors to exploit this specific vulnerability in email parsing logic. The use of Unicode tags is not new in cybersecurity, but its application to systematically break down financial terminology marks a distinct escalation in phishing sophistication.

Security experts warn that organizations relying solely on keyword-based filtering may be vulnerable to this approach. The technique requires updates to detection algorithms capable of normalizing text before analysis or identifying the presence of obfuscation characters within message bodies. Microsoft has updated its Defender for Office 365 defenses to detect and block emails utilizing this specific Unicode manipulation, but the underlying method remains a concern for other security vendors and enterprise email systems.

As of the report's publication, there is no indication that the campaign has ceased or that the threat actors have moved to new obfuscation techniques. The global nature of the attacks suggests that victims may span various industries, with financial sectors potentially facing the highest risk. Security teams are advised to monitor for similar patterns in their own email traffic and ensure their filtering solutions can handle text normalization.

Questions remain regarding the specific threat group responsible for orchestrating the campaign and whether this technique is being sold as a service on underground markets. Additionally, it is unclear how long the invisible tag method will remain effective before widespread adoption of countermeasures renders it obsolete.