ASCII Smuggling: A Loan Lure That Hides Its Keywords in Invisible Text

An ASCII smuggling phishing campaign hid financial lure words inside invisible Unicode characters: one hidden character inside a word such as funding made the word look normal to the reader and unreadable to a keyword filter.

ASCII smuggling is the use of invisible or non-rendering Unicode characters to conceal text. It became known as a way to hide instructions from people while an AI model reads them. Here it was turned to an older purpose, spam-filter evasion: the hidden character does not carry a message, it only cuts the word in two for any rule that looks for the whole word.

Analysis based on reporting by The Hacker News (4 September 2026) and TNW (6 September 2026) on a vendor research post of 3 September 2026. The same delivery route is part of a longer story: the reporting links the campaign to a September 2025 operation that sent AI-generated phishing emails to small-business loan applicants. Threat Watch has covered scanner cloaking in AI phishing kits and AegisAI has written about hidden text that an AI reader sees and a person does not.

How do invisible Unicode characters bypass email filters?

The bypass has five steps. Steps 1 and 2 are the character and where it goes; steps 3 to 5 are what the reader, the filter and the relay each do with it.

1. Unicode holds a block called Tags, U+E0000 to U+E007F. It was designed for language tagging, which the Unicode Standard now describes as strongly discouraged, and it contains a shadow copy of printable ASCII: U+E0041 mirrors "A" and U+E0061 mirrors "a". Most fonts and mail clients draw nothing for these code points.
2. The campaign inserted one such character inside lure keywords. The reported example is "fun" followed by U+E0020 (TAG SPACE) and "ding", for the word funding.
3. The reader sees funding. The reporting says the word still reads normally to the recipient.
4. A rule that looks for the literal word, or a simple regular expression, no longer finds one contiguous string, so it does not match. Text classifiers that split words into fragments may also meet fragments they have not seen; that last point is AegisAI's reading, not a reported finding.
5. The finance-themed sender domains were not the infrastructure that sent the mail. The messages were relayed through ActiveCampaign, a legitimate email-marketing platform, which lent the traffic its IP reputation and authentication.

What each side sees

The table compares the same lure word before and after the split. It is AegisAI's illustration of the reported mechanism.

The reported timeline

Why did the campaign send through a legitimate marketing platform?

The platform supplied what a new attacker domain cannot: reputation. The messages were relayed through ActiveCampaign, which rewrites every outbound link to pass through its own click-tracking domains, acemlnd[.]com and activehosted[.]com, so neither the sender domain nor the visible links pointed at attacker-owned infrastructure. TNW reports that about 92 percent of the volume came from one of the platform's network blocks.

The sender domains were disposable and finance-themed. The reporting lists the ten busiest, including guardiangrowthfunding[.]com, digitalcapitalboost[.]com and thebusinessloanexpress[.]com, and says the names were assembled from a shared vocabulary of finance words. That makes the pattern, not any one name, the useful signal, as the domains change while the vocabulary stays.

ActiveCampaign told the researchers that it tested its own content moderation against invisible-character messages, that they received the same verdicts as the unobfuscated versions, and that heavy use of the technique is treated as a suspicious signal. The platform's verdict does not remove the problem for a receiving organization, which still decides what reaches an inbox.

How can defenders detect or strip Unicode tag characters before keyword matching?

Normalize first, then match. The researchers' main advice, as reported, is to remove or fold invisible code points from subject lines and bodies before any keyword, signature or regular-expression check runs. Tag characters are rare in ordinary email, so their presence is also a high-confidence signal in its own right.

One legitimate use exists. The England, Scotland and Wales flag emoji are built from a black flag followed by tag characters, so a rule should alert on tag characters outside those sequences, not on every one.

What this means for a security team

This section is AegisAI's analysis. The reporting does not name a sector, and a funding offer is a lure for any organization with owners or finance staff who might want credit. The more useful question is internal: which rules in the mail path depend on reading words, and which of them run before text is normalized.

Three questions settle the exposure: whether subject and body text is normalized before keyword and classifier rules run, whether any AI assistant or agent reads mail before that step, and whether mail from shared marketing platforms is allowed through on platform reputation alone.

Why standard controls miss it

This section is AegisAI's analysis. Content rules judge the characters they are given, and here the characters were chosen by the sender. Reputation rules judge the platform, and the platform was real. What remains is the request: an unsolicited offer of money, sent in bulk, with a link. The reporting does not publish the landing pages, so what the links asked for is not known. A filter that reads the message and its purpose, rather than matching its spelling, does not depend on one code point.

How AegisAI protects against it

AegisAI has not observed this campaign. The reporting shows that the lures arrived as email relayed by a marketing platform, so the approach below is how AegisAI treats a lure of this shape when it arrives by email. It does not describe what happened to any specific recipient.

AegisAI does not classify infrastructure. It classifies intent. A lure with no attacker-owned infrastructure still has to ask the recipient to do something on the attacker's behalf, and that request is what gets classified, independent of how clean the destination URL is.

AegisAI's agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it. More on how that works: inbound email security.

See a loan lure like this investigated How inbound protection works

How AegisAI stops credential phishing, 48 seconds

Recommendations for defenders

• Normalize subject and body text before any keyword, signature or regular-expression rule runs: strip or fold U+E0000 to U+E007F and other zero-width and invisible code points, and keep the original text as evidence.
• Alert on tag characters that sit outside the emoji flag sequences, and route those messages for review instead of silently dropping the characters.
• Run the same normalization before any AI assistant, summarizer or agent reads mail, so hidden characters cannot carry instructions to a model.
• Do not allow-list shared marketing platforms on platform reputation. Weigh the sender domain pattern, the sending schedule and the content of the request as well.
• Tell finance and owner-operator staff that unsolicited funding and loan offers go through a known lender relationship, never through a reply or a link in an unexpected message.

FAQ