{"id":2005,"date":"2026-09-05T07:23:00","date_gmt":"2026-09-05T00:23:00","guid":{"rendered":"https:\/\/vncybers.vn\/canh-bao-phishing-ky-tu-unicode-vo-hinh-ne-bo-loc-email\/"},"modified":"2026-09-05T07:23:00","modified_gmt":"2026-09-05T00:23:00","slug":"phishing-invisible-unicode-email-filter-evasion","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/canh-bao-phishing-ky-tu-unicode-vo-hinh-ne-bo-loc-email\/","title":{"rendered":"Phishing warning: Attackers use invisible Unicode characters to avoid email filters"},"content":{"rendered":"

Microsoft is warning about a large-scale phishing campaign that abuses invisible Unicode characters to split financial keywords inside emails, reducing the chance that email filters will recognize them. According to The Hacker News, the campaign can send up to 2.37 million emails in a working day, showing a high level of automation and major operational pressure on enterprise email defenses.<\/p>\n

The notable point is that the technique does not rely on complex malware at the first stage. Instead, attackers interfere with how content is parsed by scanning systems. To a reader, the message can still look like a normal financial, funding or payment lure. To a filter, sensitive words have been broken up with hidden characters, making tokenization and pattern matching harder.<\/p>\n

\"Nh\u00e2n<\/p>\n

How invisible Unicode works<\/h2>\n

Unicode includes many character groups used for display, labeling and text control. Some characters do not appear on screen, but still exist inside the content string. Microsoft said attackers used invisible tag characters to split lure words related to finance. When a user opens the email, the human eye can still understand the general meaning, while a string-based filter may fail to recognize the original keyword.<\/p>\n

This approach is dangerous because it exploits the gap between how people see content and how security systems process text. Many email filters still combine keyword lists, semantic models, URL analysis, infrastructure reputation and sender behavior. If one layer of analysis is distorted, the remaining layers must be strong enough to detect suspicious signals.<\/p>\n

Why this campaign matters<\/h2>\n

First, the sending volume is large enough that organizations cannot rely on manual handling. When millions of emails are distributed in a short time, even a small pass-through rate can create a significant number of victims.<\/p>\n

Second, the technique is low-cost and reusable. Attackers do not need to invent a new vulnerability in email software; they only need to modify content to bypass some assumptions in scanning logic. This is a common adaptation pattern in modern phishing: changing the visual surface, sending infrastructure, domains or path structure to extend a campaign's lifetime.<\/p>\n

Third, financial themes remain effective lures. Messages about funding, invoices, payments, budgets or account confirmation often create pressure to respond quickly. When users are busy, a seemingly legitimate email can lead to a link click, credential entry or unsafe file download.<\/p>\n

Implications for organizations and users<\/h2>\n

For organizations, the incident shows that email defense needs to normalize content before analysis. Security systems should remove or safely interpret control characters and invisible characters before keyword matching, semantic assessment and link inspection. Logging normalized content also helps SOC teams investigate filter-evasion campaigns more effectively.<\/p>\n

Organizations should also combine email protection with multi-factor authentication, risk-based sign-in controls and phishing awareness training. An email that gets past a filter should not automatically become a severe incident if the account is protected by phishing-resistant MFA, the browser blocks deceptive pages and users know how to verify the sender before acting.<\/p>\n

For individual users, warning signs include emails that push urgent action around money, funding, invoices or account changes. If a message contains a login link, unexpected attachment or request to confirm sensitive information, users should access the service through its official address instead of clicking directly from the email.<\/p>\n

Defensive Lessons<\/h2>\n

Phishing is not only a problem of fake content, but also a race over how content is encoded, displayed and analyzed. Invisible Unicode characters are a clear example: the same message can have two different shapes, one for human eyes and one for scanners.<\/p>\n

To reduce risk, organizations should treat email as a chain of signals rather than a single checkpoint. Text normalization, sender-behavior analysis, real-time URL inspection, link isolation, phishing-resistant MFA and rapid incident response are more effective than relying only on a fixed keyword list.<\/p>\n

This event also reinforces a familiar principle: attackers do not need to break an entire system if they can distort one small processing step. Modern defense therefore has to care about low-level details too, from hidden characters in email to the way users are guided after a click.<\/p>\n

VNCyberS<\/strong> compiled from The Hacker News and Microsoft Security Research<\/em><\/p>","protected":false},"excerpt":{"rendered":"

Microsoft c\u1ea3nh b\u00e1o m\u1ed9t chi\u1ebfn d\u1ecbch phishing quy m\u00f4 l\u1edbn \u0111ang l\u1ee3i d\u1ee5ng c\u00e1c k\u00fd t\u1ef1 Unicode v\u00f4 h\u00ecnh \u0111\u1ec3 chia nh\u1ecf nh\u1eefng t\u1eeb kh\u00f3a t\u00e0i ch\u00ednh trong email, qua \u0111\u00f3 l\u00e0m gi\u1ea3m kh\u1ea3 n\u0103ng b\u1ecb b\u1ed9 l\u1ecdc th\u01b0 \u0111i\u1ec7n t\u1eed nh\u1eadn di\u1ec7n. Theo The Hacker News, chi\u1ebfn d\u1ecbch n\u00e0y c\u00f3 th\u1ec3 ph\u00e1t t\u00e1n t\u1edbi […]<\/p>\n","protected":false},"author":2,"featured_media":2004,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[784,591,782,785,783,781,38,85,153,780],"class_list":["post-2005","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-bao-mat-email","tag-email-security","tag-loc-email","tag-lua-dao-truc-tuyen","tag-mfa-chong-phishing","tag-microsoft-security-research","tag-phishing","tag-social-engineering","tag-the-hacker-news","tag-unicode-vo-hinh"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2005","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2005"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2005\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2004"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2005"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2005"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2005"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}