Microsoft Warns of High-Volume Phishing Campaign Using Invisible Unicode Characters to Evade Email Filters

Microsoft Security Research has alerted the industry to a high-volume phishing campaign that employs invisible Unicode tag characters to evade email filtering systems. Rather than concealing malicious instructions from human observers, the threat actor utilizes these characters to split financial lure words—such as fragmenting 'funding'—thereby disrupting the parsing mechanisms of email security gateways. The technique allows the malicious content to pass through filters that would otherwise flag standard phishing lures. The campaign has been observed on a global scale, targeting email users worldwide. Microsoft notes that no direct software exploit is involved; the risk stems from the enhanced social engineering potential of emails that appear legitimate while bypassing automated defenses. The exact number of emails dispatched and the total count of compromised or targeted accounts have not been independently verified. Microsoft recommends increased user vigilance, tuning of email filter configurations, and awareness of Unicode-based evasion tactics as primary mitigation strategies.