Almost every trick I write about here is a trick about seeing. A letter swapped for one that looks the same. A domain that reads fine until you read it from the right. Change the font, blow the text up, and the fake usually gives itself away. This one is different. The character doing the work isn't disguised. It doesn't draw anything at all.

What's actually in the email?

In early September, Microsoft's security team published what its filters had been watching since February, and BleepingComputer wrote it up the same week. The technique has a name: ASCII smuggling. Hiding content inside text that looks perfectly normal, using Unicode characters that never render.

The characters come from the Unicode Tags block, U+E0000 to U+E007F. Microsoft calls it a shadow copy of printable ASCII: a full set of code points mirroring the ordinary keyboard characters, added years ago for language tagging and now largely deprecated. They occupy space in a string. They have no shape.

The lure Microsoft shows is a single word: fun⟨U+E0020⟩ding. Between "fun" and "ding" sits U+E0020, the invisible TAG SPACE. On your screen it just says funding. 😅

You readfundingone ordinary word, seven visible letters
The filter readsfun · dingtwo fragments, split by a character with no shape

Why bother hiding a character inside "funding"?

Because a great deal of email security reads words.

First of all, there are keyword lists and regular expressions. A filter told to look at finance-themed lures watches for words like funding, capital, loan, advance, credit. Split the word and the match is gone. Nothing on screen changed.

Then there's the modern half. Machine-learning classifiers chop text into tokens before they judge it, and Microsoft spells out what an invisible character does to that step: funding may split into "fun", a tag character, and "ding", producing rare or unknown sub-tokens. The model is handed fragments it has barely seen instead of one word it knows well. And if the system normalizes text first, stripping the tag characters before it reads, the whole trick evaporates. That's the entire defence, and it's also Microsoft's recommendation.

The technique isn't clever. It's cheap. That's usually worse. 🤓

How big did this get?

Big enough to be visible from orbit, briefly. Microsoft's telemetry shows around 21,000 messages hitting the signature on 8 February, then more than 1.3 million the next day. Roughly two orders of magnitude, overnight. It peaked at over 2.3 million messages in a single day on 11 February. Across that first phase, weekday volumes ran between one and 2.37 million messages, peaking on 26 February.

It didn't stay there. By late March, weekday volumes were down by roughly 80%. The high-volume phase lasted about three months after 9 February and dropped sharply after 15 May 2026, though BleepingComputer notes the operation is still active.

The sender side is the detail I keep coming back to. On 9 February, Microsoft identified a cluster of 148 finance-themed sender domains accounting for about 96% of everything its new Unicode-tag hunting logic flagged. The domains used words like funding, capital, loan, advance and credit. One trick in the text, one small pile of domains behind it.

A nuance the headlines flatten: Microsoft is explicit that this campaign did not encode a hidden ASCII message in the tag block. It used a single invisible tag character as a separator, sprinkled inside high-signal words. Strictly speaking that's invisible-character insertion using a code point from the ASCII-smuggling block, not full message smuggling. No secret instructions were buried in the text.

Did it actually work?

Mostly no. And how it failed is the part worth keeping.

Microsoft says Defender still caught over 99% of these messages. Not by reading the body, though. It caught them on other signals: the sender, the IP, the domain, reputation checks. The words were rewritten; the infrastructure behind them wasn't.

Of course, that's Microsoft's own filtering result on its own platform. It isn't a promise about your inbox, and it isn't something my extension or any other tool can claim on your behalf. But the shape of it is a genuinely useful lesson for a person reading a suspicious email at eight in the morning. 😉

So the message body isn't evidence?

Not the way we've been taught, no.

Most of us learned to read a phishing email for tells: clumsy grammar, odd spacing, a misspelled brand name, a strange line break. Every single one of those lives in the message body. And the body is the attacker's text field. They control every character in it, including the ones that don't show up on your screen.

That cuts both ways, by the way. A flawless, well-written, perfectly branded email is not reassurance either. Urgency is still a fine reason to slow down. It just isn't proof of anything on its own.

What an attacker controls far less is where the message came from. The sender domain has to be registered somewhere, by someone, on some date, and it either matches the brand it claims or it doesn't.

Isn't this just the lookalike-domain trick again?

Same family, different target, and the difference is worth keeping straight.

Invisible and lookalike characters in the address are an older story, and two posts here already cover it: the letter-swap trick your eyes can't catch and lookalikes from another alphabet. Back in 2025, BleepingComputer covered a Booking.com campaign that used the Japanese hiragana character ん, which renders like a forward slash on some systems, to make a phishing link read like a real one. That's an old trick aimed at your eyes.

What's new this September is the same underlying idea pointed somewhere else: at the words in the message, to get past a filter rather than to fool a person. You were never meant to notice this one. The filter was.

What do you look at instead?

  1. Stop grading the writing. Grammar, spacing and tone tell you nothing reliable here. Skip that whole step.
  2. Find the real sender domain. Open the actual address, not the display name. The display name is free text and anyone can type "Payroll Support" into it. What matters is the part after the @.
  3. Don't click to investigate. Copy a link's real destination instead of following it. The one-minute version of this check is written up separately.
  4. Check the domain, not the message. How old is it, has anyone reported it, is it a near-copy of a brand's real address.
  5. If it claims to be your bank, courier or employer, go to them the way you always do. Type the address yourself, or open the app. Never through the message.

What can IP Tracker do here, and what can't it?

IP Tracker is a free Chrome extension I built. Paste a domain or a full email address into the popup and it flags lookalikes of roughly 125 widely impersonated brands, checks Google Safe Browsing, and shows WHOIS, DNS records, hosting and community abuse reports. 50 checks a day, no account, no tracking. Only the value you paste is looked up.

Unfortunately, on the specific trick in this article it can do almost nothing, and I'd rather say that plainly:

"Not flagged" is not the same as "safe." Every result here is a signal for your judgement, not a verdict. IP Tracker names the tricks it can see on a domain. It can't read your mail, it can't stop anything, and it won't promise you a site is fine.

To summarize:

The invisible character was aimed at a machine. The domain is still aimed at you, and that's the one you can actually read.

Read the sender, not the spelling! 😎

Sources