Threat Overview
Microsoft published new research on September 3, 2026 showing attackers repurposing Unicode Tags block characters, commonly associated with ASCII-smuggling and prompt-injection research, to evade phishing and spam content detection. The observed campaign inserted invisible Unicode tag characters such as U+E0020 inside financial lure words so the text rendered normally to recipients while literal keyword or token-based detection could process a different character sequence. Microsoft connected the activity to a broader ActiveCampaign-delivered SBA-themed phishing campaign. The high-volume phase began in February 2026 and dropped sharply after May 15, with residual activity through mid-June. This is newly published defensive research on a previously active campaign, not evidence that a new campaign started this week.
References
- Microsoft Security Blog, September 3, 2026: https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/ – SC Media, September 4, 2026: https://www.scworld.com/news/ascii-smuggling-challenges-email-phishing-filters-microsoft-warns
Impacted Systems
Primary exposure: organizations receiving Internet email, especially environments using automated spam/phishing classification, keyword matching, or AI-assisted email processing. Microsoft Defender for Office 365 customers can hunt the infrastructure pattern in EmailEvents and EmailUrlInfo. The invisible tag characters themselves are generally not available in EmailEvents message-body fields, so direct content hunting may require mail-content inspection outside Sentinel. Microsoft observed finance-themed sender domains, envelope sender patterns containing em-<digits>, acems<digits>, or emsd<digits>, tracking URLs on activehosted.com and acemlnd.com, and heavy use of 173.236.20.0/24. Microsoft explicitly cautions that the tracking domains and sending IP range belong to legitimate shared marketing infrastructure and are not malicious IOCs by themselves.
Why this matters
The technique creates a mismatch between what a human sees and what automated systems parse. It is broadly applicable to phishing defense, and the same normalization problem matters for AI assistants that ingest raw email content. The campaign reached multi-million-message daily volume during its peak, making the technique operationally relevant even though the high-volume phase predates this report.
Criticality: Medium-High
Exploitation Status
Confirmed historical campaign activity in Microsoft telemetry. Microsoft observed the specific tag-character technique at high volume from February through May 2026, with residual activity through mid-June. The newly published September research does not claim that the same high-volume phase is ongoing at the time of this report.
What this hunt looks for
Available Microsoft Sentinel telemetry can be reviewed for the campaign’s sender-domain vocabulary, envelope-sender shapes, shared tracking domains, sending IP range, and Microsoft Defender for Office 365 prompt-injection detections where EmailEvents and EmailUrlInfo are ingested. The Unicode tag characters in message body content are not directly exposed in the standard EmailEvents fields used here.
Required logs
- Microsoft Defender for Office 365 EmailEvents
- Microsoft Defender for Office 365 EmailUrlInfo
- DetectionMethods populated in EmailEvents for Prompt Injection Protection correlation where available
First Pass – Finance-Themed Sender With Campaign Envelope Pattern
let kwds = @"(capital|fund|hedge|express|solutions|choice|lend|growth|loan|loc|finance|business|pillar|advance|boost|catalyst|digital|direct|elevate|guardian|harbor|online|pulse|rocket|rush|united|wave|way|surge|swift|elite)";
EmailEvents
| where TimeGenerated > ago(30d)
| where EmailDirection == "Inbound"
| where SenderFromDomain matches regex strcat("(?i)", kwds, kwds, kwds)
| where SenderMailFromDomain matches regex @"(?i)(em-|acems|emsd)\d"
| project TimeGenerated, NetworkMessageId, RecipientEmailAddress, SenderFromAddress, SenderFromDomain, SenderMailFromDomain, SenderIPv4, Subject, DeliveryAction, ThreatTypes, DetectionMethods
| order by TimeGenerated descTracking URL Correlation
let kwds = @"(capital|fund|hedge|express|solutions|choice|lend|growth|loan|loc|finance|business|pillar|advance|boost|catalyst|digital|direct|elevate|guardian|harbor|online|pulse|rocket|rush|united|wave|way|surge|swift|elite)";
EmailEvents
| where TimeGenerated > ago(30d)
| where EmailDirection == "Inbound"
| where SenderFromDomain matches regex strcat("(?i)", kwds, kwds, kwds)
| join kind=inner (EmailUrlInfo | where TimeGenerated > ago(30d) | where UrlDomain endswith "activehosted.com" or UrlDomain endswith "acemlnd.com" | project NetworkMessageId, Url, UrlDomain) on NetworkMessageId
| project TimeGenerated, RecipientEmailAddress, SenderFromAddress, SenderFromDomain, SenderMailFromDomain, SenderIPv4, Subject, Url, UrlDomain, DeliveryAction, DetectionMethods
| order by TimeGenerated descPrompt Injection Protection Detections in Email
EmailEvents
| where TimeGenerated > ago(30d)
| where DetectionMethods has "Prompt Injection Protection"
| project TimeGenerated, NetworkMessageId, RecipientEmailAddress, SenderFromAddress, SenderFromDomain, SenderMailFromDomain, SenderIPv4, Subject, DeliveryAction, ThreatTypes, DetectionMethods
| order by TimeGenerated descFinance-Themed Sender Domains at Unusual Volume
let kwds = @"(capital|fund|funding|loan|loc|lend|finance|business|express|growth|solutions|choice|pillar|advance|boost)";
EmailEvents
| where TimeGenerated > ago(30d)
| where EmailDirection == "Inbound"
| where SenderFromDomain matches regex strcat("(?i).*", kwds, ".*")
| summarize Messages=count(), Recipients=dcount(RecipientEmailAddress), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SenderFromDomain
| where Messages >= 20
| order by Messages descCampaign Sending Range as Corroboration
EmailEvents
| where TimeGenerated > ago(30d)
| where EmailDirection == "Inbound"
| where ipv4_is_in_range(SenderIPv4, "173.236.20.0/24")
| summarize Messages=count(), Recipients=dcount(RecipientEmailAddress), Domains=make_set(SenderFromDomain,50), Actions=make_set(DeliveryAction,20) by bin(TimeGenerated, 1d)
| order by TimeGenerated descEnvelope Sender Shape Without Finance Filter
EmailEvents
| where TimeGenerated > ago(30d)
| where EmailDirection == "Inbound"
| where SenderMailFromDomain matches regex @"(?i)(em-|acems|emsd)\d"
| summarize Messages=count(), Recipients=dcount(RecipientEmailAddress), HeaderDomains=make_set(SenderFromDomain,50), SourceIPs=make_set(SenderIPv4,50) by SenderMailFromDomain
| order by Messages descCampaign Messages Delivered to Inbox
let kwds = @"(capital|fund|hedge|express|solutions|choice|lend|growth|loan|loc|finance|business|pillar|advance|boost|catalyst|digital|direct|elevate|guardian|harbor|online|pulse|rocket|rush|united|wave|way|surge|swift|elite)";
EmailEvents
| where TimeGenerated > ago(30d)
| where EmailDirection == "Inbound"
| where SenderFromDomain matches regex strcat("(?i)", kwds, kwds, kwds)
| where SenderMailFromDomain matches regex @"(?i)(em-|acems|emsd)\d"
| where DeliveryAction in~ ("Delivered","DeliveredToJunk")
| project TimeGenerated, RecipientEmailAddress, SenderFromAddress, SenderFromDomain, SenderMailFromDomain, SenderIPv4, Subject, DeliveryLocation, DeliveryAction, ThreatTypes, DetectionMethods
| order by TimeGenerated descDetection Notes
Highest precision comes from combining the finance-themed header-domain pattern with the envelope-sender shape. activehosted.com, acemlnd.com, and 173.236.20.0/24 are shared legitimate infrastructure and must not be treated as standalone malicious indicators. EmailEvents does not expose the message body in a way that permits direct searching for U+E0000-U+E007F, so Sentinel hunting is primarily infrastructure- and detection-method-based. Microsoft reports that more than 99% of the observed messages were detected through layered protections that did not depend on the Unicode-tag signature alone.
Killian Sherer 