Microsoft tracks ASCII smuggling in phishing mail

Microsoft Security published a research blog on 3 September 2026 from Defender for Office 365 prompt-injection hunting. The writeup tracks a phishing-evasion technique, not a CVE or a patch advisory, and it is not a finding that ActiveCampaign is malware.

Attackers reused the Unicode Tags block (U+E0000 to U+E007F), including TAG SPACE U+E0020, to split finance lure words such as "funding." Humans still read the word. Keyword, regex, and tokenizer checks that do not normalize first can miss it.

Signature hits jumped from about 21,000 on 8 February 2026 to more than 1.3 million on 9 February. Weekday volumes then ran from 1 million to 2.37 million, with the 2.37 million peak on 26 February. The cadence was weekday on and weekend off. The high-volume phase dropped after 15 May, with residual hits into mid-June.

Roughly 150 finance-themed disposable sender domains drove about 96 percent of that signature cluster. On 9 February alone, guardiangrowthfunding.com logged 30,442 hits. The brand names were recombinations of a 28-token finance vocabulary. Clicks went through ActiveCampaign tracking hosts (acemlnd.com and activehosted.com), while envelope senders used em-, acems, and emsd shapes.

About 92 percent of measured volume came from 173.236.20.0/24. Microsoft describes that block as shared platform egress and corroboration, not a standalone indicator. ActiveCampaign said invisible Unicode gets the same moderation verdict as the unobfuscated text, and that heavy use is itself a suspicious signal.

Microsoft ties this phase to a longer Fortra-documented, ActiveCampaign-relayed SBA-themed campaign that existed before Unicode tags and continued after the tags dropped. Layered Defender for Office 365 controls flagged the majority of messages without relying only on the Unicode signal. The company says over 99 percent of those hits came from other layers.

The writeup's defense step is mechanical: strip or fold the tag block and other invisible characters before any keyword or regex match. Leftover tag-block characters count as an anomaly, excluding known flag-emoji sequences. The same normalize-first step also cuts prompt-injection risk when mail is later ingested by an assistant.

Some offers on this page may be paid placements or contain affiliate links.