Latest / The Digital Warfare Podcast / EP. 157: Hackers Use Invisible Unicode to Bypass Email Security
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today we're looking at a phishing technique where the email you see is not necessarily the same text your security system reads. Attackers are using invisible Unicode characters to manipulate how phishing messages are processed by email defenses. The technique is known as ACI smuggling, and what's particularly interesting is where it came from. ASHI smuggling gained attention as a technique for hiding malicious instructions inside content processed by artificial intelligence. Now attackers have adapted the same concept for something much older: phishing. Here's what happened: Microsoft researchers discovered a large-scale financial phishing campaign using characters from the Unicode tags block, specifically U plus E0000 through U plus E007F. These characters have an unusual property. Software can process them, but most fonts and interfaces don't visibly render them. So an attacker can insert one inside an ordinary word without the recipient seeing anything unusual. Imagine the word funding. To you, it still looks like funding. But underneath, the attacker can insert an invisible Unicode tag character between the letters. A basic detection system looking for the literal word may no longer see the same sequence. The human sees the lure. The security filter sees something different. And the scale was significant. Microsoft's detection telemetry showed roughly 21,000 signature hits on February 8th. One day later, more than 1.3 million. On February 11, the volume peaked above 2.3 million messages. The high-volume campaign continued for roughly three months before declining sharply after May 15th. Although residual activity continued afterward, the messages primarily used financial themes: business funding, loans. Lines of credit, and similar offers. Attackers rotated through roughly 150 finance-themed sender domains while inserting invisible characters into high-signal words that email filters might otherwise recognize. But there's an important distinction. This wasn't primarily an AI prompt injection attack. The attackers were not hiding commands for an AI assistant. They were taking a technique made prominent by AI security research and repurposing it to interfere with traditional phishing detection, same mechanism, different objective. And that matters because cyber techniques rarely remain confined to the environment where they first become popular. Once attackers understand an evasion method, they experiment. Microsoft found that more than 99% of the messages in this activity were still detected by other protection layers. Sender reputation, IP and domain reputation, machine learning classification, brand impersonation detection, authentication checks, and other signals. That tells us something important about defensive architecture. Do not rely on a single signal. A keyword rule can fail. A URL reputation check can fail. An authentication control can fail. Security becomes stronger when multiple independent signals have to fail before an attack reaches the user. For defenders, Microsoft recommends a simple principle: normalize before you match. Before email content reaches keyword, signature, or regular expression detection logic, invisible and non-rendering Unicode characters should be stripped or normalized. Security teams should specifically examine characters in the U plus E0000 to U plus E007F range, but defenders also need context. Some legitimate Unicode sequences use these characters, including certain subdivision flag emojis. So blindly blocking every occurrence can create false positives. Organizations should also test their own email security stack, send controlled messages containing invisible Unicode characters, determine what your gateway sees, determine what your detection engine sees, and compare that with what the employee sees, because this campaign exposes a broader security problem. Machines and humans increasingly consume the same information differently. That gap creates opportunities for attackers. And as AI becomes embedded into email, browsers, documents, and enterprise workflows, attackers will continue looking for ways to make malicious content appear harmless to one interpreter while remaining meaningful to another. The strategic lesson is simple: do not secure only what the user can see. Secure what the machine actually processes. Because sometimes, The most dangerous character in an email is the one nobody can see. This has been your Digital Warfare Daily Brief. Stay secure. We'll see you tomorrow.