Attackers conceal phishing lures using invisible Unicode characters

Microsoft researchers discovered a large-scale finance-themed phishing campaign that used invisible Unicode characters to evade email security filters. The campaign peaked at up to 2.37 million messages per day in late February 2026, and the source says the operation was still active in May.