A trick once used to sneak secret instructions past AI chatbots has jumped over to old-fashioned email scams — and it’s been working at massive scale.
Microsoft’s security researchers say they’ve caught a phishing campaign quietly slipping invisible characters into scam emails to sneak past spam filters, using a technique that until now mostly showed up in the world of AI safety research.
Wait, invisible characters?
Yes — actual letters and symbols that exist inside a piece of text but never show up on screen. They come from an obscure corner of the Unicode system (the giant catalogue of characters every computer uses) called the “Tags” block, originally meant for tagging languages and mostly abandoned since. Type them into an email, and a person reading it sees nothing unusual. But any system parsing the raw text — including an AI model — can still “read” them.
Over the past year or so, security researchers have used exactly this trick to demonstrate a real weakness in AI tools: you could hide secret instructions inside a document or webpage, invisible to the human eye, and an AI assistant reading that content might quietly follow them. It became a well-known party trick in AI red-teaming circles, with its own tools and writeups.
So what changed?
Microsoft’s team was actually hunting for that AI-focused threat — email-based attempts to smuggle hidden instructions to AI systems — when they noticed something odd. Starting February 9, 2026, they saw a huge spike in emails using these invisible characters. But when they opened the emails up, there were no secret AI instructions hidden inside at all.
Instead, scammers had found a completely different use for the same trick: breaking up spam-trigger words so filters couldn’t recognize them, while the message still looked completely normal to a human reader. So a word like “funding” would have an invisible character slipped right into the middle of it — invisible to you, but potentially confusing enough to trip up a filter that’s just looking for the literal word “funding.”
How big was this?
Big. The day before the spike, the detection Microsoft was using flagged about 21,000 messages. The very next day, that jumped past 1.3 million — and at its peak, over 2.3 million emails in a single day. The campaign kept this up on weekdays for roughly three months, going quiet every weekend like clockwork — a telltale sign of scheduled, automated spam infrastructure rather than a one-off attack.
The emails themselves were fairly ordinary-looking business scams: fake loan offers, credit lines, and “funding” pitches sent from around 150 disposable, finance-themed web addresses with names like “guardiangrowthfunding.com” — all built by shuffling the same 20-odd buzzwords like capital, boost, funding and express. The mail itself was actually routed through a legitimate email-marketing service, ActiveCampaign, whose infrastructure the scammers appear to have abused — something the company says it takes seriously and is working to detect.
Does the trick actually work?
Sort of, and that’s the interesting part. A simple filter looking for an exact word match could indeed get fooled by the broken-up spelling. But the bigger target was likely the smarter, AI-driven spam filters that most email providers now use — those often break words into smaller chunks before analyzing them, and an invisible character stuck in the middle can throw that process off entirely.
The good news: because this specific trick is so rare in ordinary email traffic, its very presence is a strong tell that something’s off — which cuts both ways for defenders. Microsoft says the vast majority of these messages were still caught anyway, thanks to other layers of protection like sender reputation and behavior-based detection, not just because of the invisible characters themselves.
The bigger picture
Security researchers have flagged invisible or lookalike characters as a spam trick for years — this isn’t entirely new ground. What is new is which invisible characters got used, and the sheer scale of it. The takeaway Microsoft is pointing to is broader than one campaign: a technique that shows up first in AI security research doesn’t necessarily stay there. Attackers watch what works in one corner of the industry and quietly repurpose it elsewhere — meaning defenders need to keep an eye on AI-security research even when their day job is stopping plain old email scams.
