Microsoft recently investigated a high-volume phishing campaign that used invisible Unicode tag characters, a technique popularized in AI prompt injection research as “ASCII smuggling.” Instead of using these characters to hide instructions from people while exposing them to AI models, the attacker used them to split financial lure words like “funding” to prevent email filters from parsing them.

The researchers identified 45 network IoCs comprising 20 domains and 25 IP addresses related to the threat. We confirmed that none of the domain IoCs were owned by legitimate entities using the WhoisXML API MCP Server so we proceeded with our analysis that led to these discoveries:

• Two unique client IP addresses that communicated with one of the domain IoCs
• Five domain IoCs that were likely registered with malicious intent
• 19 distinct IP addresses potentially owned by victims that communicated with six of the IP IoCs
• 137 email-connected domains
• 19 additional IP addresses, eight were confirmed malicious
• Nine IP-connected domains

Note that while Microsoft identified 148 phishing domains in all, they only published 20 in their report. We analyzed the sample domains and in the end collated 165 connected artifacts, 158 of which have not been detected by any of the engines listed on VirusTotal.

A sample of the additional artifacts obtained from our analysis is available for download from our website.

Analyzing the Attack Domain IoCs

We kicked off our investigation by looking more closely at the 20 domain IoCs.

First, sample network traffic data from the IASC revealed that two unique client IP addresses under two ASNs communicated with the domain IoC directcapitalboost[.]com via four DNS queries on 1 August 2026.

Using data from the First Watch Malicious Domains Data Feed, we discovered that five of the domain IoCs were likely registered with malicious intent between 345 and 630 days before Microsoft identified them as IoCs on 3 September 2026. Take a look at more information for three examples below.

Next, we queried the domain IoCs on WHOIS API and learned that:

• They were created between 13 May 2021 and 23 September 2025, making them all fairly aged when they were weaponized for the attack.

  

• They were all administered by GoDaddy and registered in the U.S.

Finally, we queried the domain IoCs on DNS Chronicle API and found out that they recorded 2,292 historical domain-to-IP resolutions over time. Here are more details for five examples.

Investigating the Attack IP IoCs

Next up, we investigated the 25 IP IoCs further.

First, sample network traffic data from the IASC revealed that 19 unique IP addresses that could belong to victims communicated with six of the IP IoCs between 13 March and 7 September 2026. They fell under five distinct ASNs.

We then queried the IP IoCs on Bulk IP Geolocation Lookup and discovered that they were all geolocated in the U.S. although their ISPs were not named.

The results of our DNS Chronicle API queries for the IP IoCs, meanwhile, showed that 23 of them posted 9,264 historical IP-to-domain resolutions over time. Take a look at more information for five examples below.

Hunting for New Artifacts

Next, we kicked off our search for new artifacts.

First, we queried the domain IoCs on WHOIS History API and discovered that one had a public email address in a historical WHOIS record.

We then queried the public email address on Reverse WHOIS API and uncovered 137 unique email-connected domains after those already dubbed as IoCs were filtered out.

According to data obtained from Domain Traffic API, three email-connected domains recorded six visits since 1 January 2026.

Here are more details about the most visited email-connected domains.

This post only contains a snapshot of the full research. Download the complete findings and a sample of the additional artifacts on our website or contact us to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

Disclaimer: We take a cautionary stance toward threat detection and aim to provide relevant information to help protect against potential dangers. Consequently, it is possible that some entities identified as “threats” or “malicious” may eventually be deemed harmless upon further investigation or changes in context. We strongly recommend conducting supplementary investigations to corroborate the information provided herein.