This is genuinely one of the more clever attack techniques i've seen in a while, and it's a little unsettling how simple the actual trick is. phishing campaigns just started using invisible unicode characters to beat email filters, and microsoft's own security team is the one who caught it. here's the mechanism, and it's worth understanding because it's not complicated once you see it. a technique called ascii smuggling was originally studied purely as an ai security risk, hiding invisible instructions inside text that a human never sees but an ai model reads and processes. it uses a specific range of unicode characters, the tags block, invisible shadow copies of normal letters that render as literally nothing on screen. attackers just took that exact same trick and pointed it at old-school email filters instead of ai models. drop one invisible character inside a word your filter is watching for. "funding" becomes "fun[invisible character]ding." you see "funding," perfectly normal. your filter's keyword match sees something else entirely and waves it through. what actually convinced me this is real and not theoretical is the scale. microsoft's own telemetry showed hits on this pattern jump from around 21,000 messages on february 8 to over 1.3 million the very next day, peaking at 2.37 million emails in a single day by late february. it ran on a consistent weekday schedule for roughly three months, quiet on weekends, back monday like clockwork, before finally dropping off in may. the lure content was financial, exactly the kind of email built to get you to click something about a transfer or an invoice. the invisible characters existed for one purpose, slipping past the automated filter sitting between the attacker and your inbox. the part that actually changed how i think about this. the visible text in a suspicious email is not necessarily what a security filter actually processed. something can look completely clean to a keyword scanner and completely normal to you too, at the same time, which is exactly the gap this technique lives in. this got fixed the way most of these things get fixed, quietly, after the fact, once someone finally noticed the pattern. worth remembering that a technique this effective ran undetected for months, and it's a pretty good preview of how much attack tradecraft is about to start borrowing from ai security research going forward.(CyrilXBT)