Unicode-tag phishing campaign uses funding lure domains
Microsoft investigated a phishing campaign that hid invisible Unicode "tag" characters inside words like "funding" to slip past email filters; CircleID analysed the business-loan lure domains it used.
- First reported
- Reports
- 1
Source: circleid.com · published
What happened
CircleID reported that Microsoft investigated a high-volume phishing campaign that used invisible Unicode tag characters, a trick known from AI prompt-injection research as "ASCII smuggling". Instead of hiding instructions for AI models, the attackers used the characters to split financial lure words such as "funding" so email filters could not recognise them.
Microsoft identified 148 phishing domains and published 20. Domains named in CircleID's analysis include advancefundingboost.com, digitalcapitalboost.com, directcapitalboost.com, fundingexpresscapital.com, guardiancapitalway.com, harboradvancefunding.com, onlinedirectfinance.com and ourbusinessloans.com. CircleID confirmed none of the domain indicators belonged to legitimate organisations.
How the scam works
The emails pitch business funding or loans. To a reader the words look normal, but invisible characters inserted between the letters mean automated filters do not see the word "funding", so the message is more likely to reach the inbox.
CircleID's analysis found some of the domains were flagged as likely malicious 345 to 630 days before Microsoft named them on September 3, 2026; that one had a public email address in historical WHOIS records, connected to 137 more domains; and that 158 of 165 connected artifacts were not detected by any VirusTotal engine.
CircleID notes that some entities flagged in this kind of research may later prove harmless.
Source
CircleID, "New Attack Type: ASCII Smuggling AI Prompt Injection Phishing Studied", citing Microsoft research.
Red flags
- Unsolicited offers of fast business funding or loans by email.
- Lender domains built from stock words like "capital", "boost" and "funding" with no track record.
- Requests to apply or share bank details through a link rather than a lender you contacted yourself.
If you were targeted
- 1Do not click links or reply to unsolicited funding offers.
- 2Look up a lender independently and confirm it is licensed before sharing any information.
- 3If you already submitted details, contact your bank and watch your accounts and credit reports.
- 4Report phishing to reportphishing@apwg.org and to the FTC at ReportFraud.ftc.gov.