Invisible Unicode Tag-Character Phishing Campaign

Technical Analysis

The campaign abuses Unicode 'tag characters' (originally designed for language tagging, largely invisible/non-rendering in most contexts) to insert zero-width or non-displaying code points inside sensitive lure terms, breaking up strings that email security gateways and NLP-based filters rely on for detection. Because the characters do not render visually, the email appears normal to the human recipient while defeating substring/keyword matching, regex-based rules, and some machine learning classifiers trained on clean text tokens. This is a variant of a broader technique class previously discussed in the context of hiding prompt-injection instructions from AI models while displaying different content to humans; here the same character set is repurposed purely for evasion rather than AI targeting, but the underlying obfuscation method is directly relevant to any AI agent or LLM-based system that ingests email, ticket, or document content for triage, summarization, or automated response, since such agents may either fail to detect the hidden characters (missing the threat) or, in other configurations, be susceptible to similar invisible-character techniques used for prompt injection. Organizations using LLM-powered email security copilots, SOC automation agents, or RAG pipelines that ingest raw email text should ensure Unicode normalization and tag-character stripping occurs before content reaches both traditional filters and AI models.

Affected Systems

Enterprise email gateways and filters (Microsoft Defender for Office 365 and third-party equivalents), organizations relying on keyword/regex-based phishing detection, AI-assisted email triage and SOC automation tools that process raw email body text

Indicators of Compromise

• No specific hashes, IPs, or domains disclosed in source reporting; indicator pattern: presence of Unicode Tag block characters (U+E0000–U+E007F) interspersed within financial/lure keywords in email body text

Remediation Steps

1. 1

   Deploy Unicode normalization at ingestion

   Configure email security gateways and any AI/LLM ingestion pipelines to strip or normalize invisible Unicode tag characters (U+E0000–U+E007F range) and other zero-width characters before content analysis.

2. 2

   Update detection signatures

   Work with email security vendors (e.g., Microsoft Defender) to ensure updated heuristics account for character-level obfuscation of lure keywords, not just literal string matching.

3. 3

   User awareness training

   Train employees to recognize financial/funding-themed phishing lures and verify sender authenticity regardless of how 'clean' the email content appears.

4. 4

   Enable advanced anti-phishing policies

   Ensure Safe Links, Safe Attachments, and impersonation protection policies are enabled and tuned for financial lure scenarios.

5. 5

   Harden AI/agent email processing pipelines

   Sanitize and canonicalize text before feeding it into any LLM-based triage, summarization, or auto-response agent to prevent both filter evasion and potential prompt-injection abuse via the same character classes.