Attackers conceal phishing lures using invisible Unicode characters

September 6, 2026 · BleepingComputer · Severity: MEDIUM

Threat actors have adopted the ASCII smuggling technique in phishing campaigns, using invisible Unicode characters to evade email security filters.

Key Takeaways

Threat actors are using ASCII smuggling with invisible Unicode characters to conceal phishing lures and evade email security filters.
Email security teams should test and validate whether their filters detect zero-width Unicode characters in message content and headers.
Users should be trained to scrutinize unexpected emails carefully, as invisible characters can make phishing links appear legitimate.