Three pieces of research from the first fortnight of September describe different techniques with one move in common. Authentication stays intact in all three. Each routes through something the recipient, or the filter, already trusts.
Relayed through ActiveCampaign
Microsoft’s security researchers published the most email-relevant of the three on 3 September. The headline is ASCII smuggling. The delivery path is what matters to senders.
The campaign spliced invisible Unicode tag characters, code points U+E0000 to U+E007F, into lure words. Write “fun”, an invisible TAG SPACE, then “ding”. A human reads “funding”. A keyword rule finds no match. The technique came out of AI prompt-injection research, though nothing here was smuggled to a model. The characters were there to beat filters.
Weekday volumes ran between 1 and 2.37 million messages, peaking on 26 February, with the campaign going near-silent at weekends. Microsoft reads that rhythm as scheduled bulk-sending infrastructure, and it was. On 9 February the researchers counted 148 finance-themed sender domains, recombinations of a small vocabulary: guardiangrowthfunding and a hundred and forty-seven like it.
Those are the header domains the recipient sees. The mail was relayed through ActiveCampaign. Envelope senders took the shape em-<digits>.<brand-domain>, with a handful of reused account numbers fanned out across hundreds of brand domains. Links were rewritten to the platform’s tracking domains. About 92 per cent of measured volume came from a single /24 belonging to the platform. Microsoft ties the activity to an earlier ActiveCampaign-delivered, SBA-themed campaign documented by Fortra.
Microsoft is careful with those infrastructure indicators and so should anyone reading this. The tracking domains and the /24 are shared by every legitimate customer of the platform. Use them to scope a search. Block on them and you block a lot of newsletters. That is Microsoft’s own point about mail from a reputable platform with established IP reputation and authentication: it complicates reputation-based filtering.
ActiveCampaign gave Microsoft a statement before publication. It says it tested the technique against its content moderation, that messages with invisible Unicode get the same verdicts as their plain equivalents, and that heavy use of the technique is itself treated as suspicious.
The evasion worked narrowly. Over 99 per cent of the messages were caught by other Defender layers. Microsoft’s guidance for anyone running their own filters is to normalise before you match. Strip tag-block and zero-width characters from subject and body before signatures run, then treat their presence as an anomaly signal. One caveat for rule writers: the England, Scotland and Wales flag emojis are encoded with tag characters and will trip a naive version.
A phishing page that never exists on a server
Barracuda described a campaign on 9 September in which there is no phishing site to block.
It opens with a DocuSign-themed email carrying a calendar invite. The invite does nothing except make the message look like ordinary business correspondence. A crafted redirect parameter moves the recipient through Microsoft OAuth into Teams, which loads an external resource from cdn.bloom[.]io. The browser converts that into a blob URL, a temporary address pointing at content held in local memory, and the credential page is assembled inside the victim’s own browser. The page registers a service worker and takes instructions from the operator’s backend.
No static page for a scanner to fetch. No domain for a blocklist. The links in the message point at genuine Microsoft endpoints. Barracuda recommends phishing-resistant MFA and link inspection that follows the full click path.
What the lures land in
CloudSEK published its findings on 7 September after getting administrator access to BigBear 2.0, a phishing-as-a-service platform running on Evilginx2. The panel held 5,137 credential records, including 474 completed MFA bypasses, and was leased to five affiliate operators. Custom JavaScript disables FIDO2 in the browser to push targets onto weaker factors. This is what the messages in the other two stories are selling tickets to.
For anyone running a sending platform, the ActiveCampaign case is the one to read properly. Any platform with self-service signup and a shared IP pool is a candidate for the same treatment. Hundreds of disposable domains built from one finance vocabulary. A weekday-only schedule. Invisible Unicode in the copy. Any one of those is odd. All three on the same few accounts is a compliance ticket.
