Attackers conceal phishing lures using invisible Unicode characters

Microsoft Security Research found attackers using invisible Unicode tag characters to split the word "funding" in spam, evading keyword filters. The campaign pushed up to 2.37 million messages daily via ActiveCampaign, with over 99% caught by other detection layers.