Microsoft Reports Phishing Campaign Using Invisible Unicode to Evade Email Filters
Summary
Microsoft says a phishing campaign inserted invisible Unicode tag characters into finance-related lure words to evade email filters, reaching an estimated 1–2.37 million messages on weekdays and using ActiveCampaign to relay emails and track links.
Key points
- The campaign used invisible characters from the Unicode Tags block to split finance-related words such as “funding,” evading filters that match contiguous keywords.
- Microsoft estimated weekday volumes of 1–2.37 million messages, with activity peaking on February 26, 2026.
- The campaign reportedly ran at high volume for about three months before dropping sharply after May 15, 2026, and largely paused on weekends.
- Hundreds of disposable, finance-themed sender domains used lures involving business loans, lines of credit, and advance funding.
- Emails were relayed through ActiveCampaign, with outbound links routed through its click-tracking domains, including acemlnd[.]com and activehosted[.]com.
- Microsoft linked the activity to a broader phishing operation targeting Small Business Administration loan applicants; Fortra had previously reported that operation collected business and financial information.
Article Details
- Event Type
- High-volume phishing campaign using invisible Unicode tag characters to evade email filters.
- Impact
- Microsoft reported that the campaign reached an estimated 1 to 2.37 million messages on weekdays, peaking on February 26, 2026. The messages used finance-themed lures and disposable sender domains; Microsoft assessed the activity as linked to a broader campaign targeting Small Business Administration loan applicants and collecting business and financial information. The emails were relayed through ActiveCampaign, whose click-tracking domains routed links. The reported activity dropped sharply after May 15, 2026.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | advancefundingboost[.]com | Finance-themed disposable sender domain listed among the campaign's top domains by hits. |
| DOMAIN | digitalcapitalboost[.]com | Finance-themed disposable sender domain listed among the campaign's top domains by hits. |
| DOMAIN | directcapitalboost[.]com | Finance-themed disposable sender domain listed among the campaign's top domains by hits. |
| DOMAIN | guardiancapitalway[.]com | Finance-themed disposable sender domain listed among the campaign's top domains by hits. |
| DOMAIN | guardiangrowthfunding[.]com | Finance-themed disposable sender domain listed among the campaign's top domains by hits. |
| DOMAIN | harboradvancefunding[.]com | Finance-themed disposable sender domain listed among the campaign's top domains by hits. |
| DOMAIN | onlinedirectfinance[.]com | Finance-themed disposable sender domain listed among the campaign's top domains by hits. |
| DOMAIN | thebusinessloanexpress[.]com | Finance-themed disposable sender domain listed among the campaign's top domains by hits. |
| DOMAIN | unitedfundingwave[.]com | Finance-themed disposable sender domain listed among the campaign's top domains by hits. |
| DOMAIN | yourlocfunding[.]com | Finance-themed disposable sender domain listed among the campaign's top domains by hits. |
Vendors
ActiveCampaignThe campaign is tied to finance-themed sender domains and ActiveCampaign infrastructure, and it shows how AI-era evasion tactics can be reused in traditional phishing operations.FortraDetails of the phishing campaign were disclosed by the Fortra Intelligence and Research Experts (FIRE) team in September 2025, stating the operation focuses on collecting detailed business and financial information,MicrosoftMicrosoft says a high-volume phishing campaign is using invisible Unicode tag characters to split finance-related lure words and evade email filters, with the activity peaking at millions of messages per day.