Microsoft security researchers have identified a new phishing campaign that embeds hidden Unicode characters in email subjects and bodies. This allows malicious links to bypass traditional spam filters and reach inboxes worldwide. The technique, previously seen in prompt injection attacks, now threatens corporate and personal users across multiple industries.
The attackers insert zero‑width spaces or similar Unicode symbols that are invisible to readers. These characters are interpreted as normal text by email clients, so filters cannot detect the altered content. As a result, phishing emails appear legitimate and evade detection mechanisms. The campaign targets both small businesses and large enterprises, showing its broad appeal. Microsoft warned that this method could increase successful phishing rates. In tests, emails containing hidden Unicode characters slipped through filters 70 percent of the time, compared to 15 percent for standard messages.
Stealthy Unicode Tricks Slip Past Spam Filters Microsoft warned that this method could increase successful phishing rates.
How do invisible characters evade detection? The hidden characters can be combined with ASCII smuggling, where seemingly benign text masks malicious URLs. This dual approach makes it harder for security tools to flag the email as suspicious.
If left unchecked, the campaign could lead to a surge in credential theft and financial loss for organizations worldwide. Experts urge users to verify links and for email providers to adopt deeper content inspection. The trend highlights email security gaps. Companies that ignore this trend risk becoming easy prey for cybercriminals.
What exactly are invisible Unicode characters? They are zero‑width or non‑displaying symbols that do not appear in the visible text but are still part of the email string. Attackers embed them to alter the content without changing what users see.
Why can traditional spam filters miss these phishing emails? Because the hidden characters are interpreted as normal text, the email’s visible wording matches legitimate messages. Filters rely on visible content and cannot detect the invisible modifications.
How can organizations protect themselves from this technique? They should train staff to hover over links before clicking and encourage email platforms to scan for unusual Unicode sequences. Regular security audits also help spot anomalous patterns.