Invisible characters hidden inside words carry phishing past the email filter

On 3 September 2026 Microsoft Security Research described a finance themed phishing campaign in which the senders placed invisible Unicode characters inside words such as "funding". The characters, the so called tag characters in the range U+E0000 to U+E007F, are not shown to the recipient, but they break the word apart for filters that rely on keywords, regular expressions or machine learning. The volume was large. Microsoft telemetry went from about 21,000 signature hits on 8 February to more than 1.3 million on 9 February, with peaks above 2.3 million messages, and weekday activity continued for about three months.

The campaign used around 150 rotating finance themed sender domains and a legitimate email marketing platform as its delivery channel. Microsoft recommends stripping or normalising the tag characters before content inspection, treating them as an anomaly signal once legitimate flag emoji sequences are excluded, and testing that both the email pipeline and pipelines feeding AI systems handle the characters consistently.

What this means for you if you own the email filter

The technique is known from prompt injection against AI systems, and it has now moved over to email. What makes it effective is that the recipient and the filter see two different texts. A filter looking for "funding" does not find it, while the reader sees the word with no idea that something is hidden inside. If your rules are built on keywords or patterns, they are blind to this until the characters are removed before the rules run.

Our view is that this belongs in the preprocessing stage as a fixed step, not as a single rule. Ask your email security vendor whether tag characters are normalised before analysis, and test it yourself with a message that contains them. If you have started letting AI tools read incoming email, the same applies there. A system that reads the text differently from the human is a system the attacker can talk to on its own.

Berigo recommends

• Confirm with your vendor whether the email filter strips or normalises Unicode tag characters before content is analysed.
• Send a test message containing such characters through the whole pipeline, and see whether it is caught.
• Treat the presence of tag characters as an anomaly signal, with an exception for legitimate flag emoji.
• Test AI systems that read email or documents in the same way, since the technique comes from there.
• Tell users that a financial request from an unknown sender must be confirmed in another channel, however clean the text looks.