Hackers Use ASCII Smuggling to Evade Phishing Detection
Attackers are using invisible Unicode characters to bypass email security controls and conceal phishing content from automated detection systems. The campaign targeted recipients with finance-themed messages promoting business funding, loans, and credit offers.
The attack relies on inserting non-rendering Unicode tag characters into high-value keywords. Although the modified words appear normal to recipients, the underlying text is fragmented, which can prevent traditional keyword matching, signatures, regular expressions, and some machine-learning-based filters from recognizing suspicious terms.
The campaign operated at significant scale, with activity reaching more than 2.3 million messages in a single day and remaining elevated for approximately three months. Attackers also used hundreds of rotating finance-themed domains and shared email-marketing infrastructure to distribute the messages and track clicks.
This technique combines technical evasion with social engineering. By disguising commonly monitored financial keywords while maintaining a legitimate-looking appearance, attackers can increase the likelihood that phishing emails reach users and potentially lead to credential theft, fraud, or other financial losses.
Security teams should normalize and inspect email content before applying detection rules. Invisible and non-rendering Unicode characters should be removed or standardized so that security systems evaluate the normalized version of the message.
Organizations should also correlate Unicode anomalies with sender reputation, authentication results, domain age and behavior, URL analysis, message volume, and visual content. Unexpected use of hidden characters should be treated as a potential phishing indicator, particularly when combined with suspicious finance-themed senders or unusual email-volume spikes.
Attack Surface
Email, Messaging, Endpoint
Tactics
Initial Access, Defense Evasion, Credential Access
Techniques
- T1566.001 – Phishing: Spearphishing Attachment
- T1566.002 – Phishing: Spearphishing Link
- T1027 – Obfuscated Files or Information
- T1140 – Deobfuscate/Decode Files or Information
- T1562.001 – Impair Defenses: Disable or Modify Tools
SuperPRO's Threat Countermeasures Procedures
- Normalize email content by removing or standardizing invisible and non rendering Unicode characters before applying security detection rules.
- Detect Unicode Tag characters such as U+E0000-U+E007F and U+E0020 when they are inserted within commonly targeted keywords.
- Flag unusual hidden characters within email content as potential indicators of phishing and detection evasion.
- Correlate Unicode anomalies with sender reputation, domain age, email authentication results, and previous sender activity.
- Monitor newly registered, rotating, or finance themed domains involved in high volume email campaigns.
- Investigate sudden increases in email volume from unfamiliar domains, particularly when multiple domains use similar naming patterns.
- Analyze redirect URLs, tracking domains, and destination infrastructure for suspicious relationships and known malicious indicators.
- Test email gateways, SIEM rules, security analytics, and AI systems to ensure hidden Unicode characters are processed consistently.
- Apply multiple detection layers by combining content analysis, sender authentication, URL inspection, reputation checks, and behavioral analytics.
- Educate employees to independently verify unsolicited funding, loan, and credit offers before clicking links or providing sensitive information.
