Date: 09/04/2026
Severity: High
Summary
Researchers uncovered a high-volume phishing campaign that repurposed ASCII smuggling may be induced to follow threat actor-controlled instructions, an AI prompt-injection evasion technique for email filter evasion. Attackers inserted invisible Unicode Tag characters into financial keywords to bypass keyword-, ML-, and NLP-based phishing detection while luring victims with business funding and credit offers. The campaign, linked to a broader Active Campaign-delivered phishing operation, demonstrates how AI-era evasion techniques can cross into traditional social engineering and credential-harvesting attacks.
Indicators of Compromise (IOC) List
Domain/URLs | guardiangrowthfunding.com digitalcapitalboost.com thebusinessloanexpress.com yourlocfunding.com advancefundingboost.com guardiancapitalway.com harboradvancefunding.com unitedfundingwave.com directcapitalboost.com onlinedirectfinance.com catalystcapitalharbor.com rocketboostfunding.com digitalrushcapital.com guardianloccapital.com guardianlocchoice.com ourbusinessloans.com directcapitalpulse.com catalystboostfunding.com elevatecapitalrush.com fundingexpresscapital.com |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "catalystcapitalharbor.com" or url like "catalystcapitalharbor.com" or siteurl like "catalystcapitalharbor.com" or domainname like "yourlocfunding.com" or url like "yourlocfunding.com" or siteurl like "yourlocfunding.com" or domainname like "guardianlocchoice.com" or url like "guardianlocchoice.com" or siteurl like "guardianlocchoice.com" or domainname like "advancefundingboost.com" or url like "advancefundingboost.com" or siteurl like "advancefundingboost.com" or domainname like "digitalcapitalboost.com" or url like "digitalcapitalboost.com" or siteurl like "digitalcapitalboost.com" or domainname like "digitalrushcapital.com" or url like "digitalrushcapital.com" or siteurl like "digitalrushcapital.com" or domainname like "guardiangrowthfunding.com" or url like "guardiangrowthfunding.com" or siteurl like "guardiangrowthfunding.com" or domainname like "unitedfundingwave.com" or url like "unitedfundingwave.com" or siteurl like "unitedfundingwave.com" or domainname like "elevatecapitalrush.com" or url like "elevatecapitalrush.com" or siteurl like "elevatecapitalrush.com" or domainname like "onlinedirectfinance.com" or url like "onlinedirectfinance.com" or siteurl like "onlinedirectfinance.com" or domainname like "fundingexpresscapital.com" or url like "fundingexpresscapital.com" or siteurl like "fundingexpresscapital.com" or domainname like "rocketboostfunding.com" or url like "rocketboostfunding.com" or siteurl like "rocketboostfunding.com" or domainname like "catalystboostfunding.com" or url like "catalystboostfunding.com" or siteurl like "catalystboostfunding.com" or domainname like "thebusinessloanexpress.com" or url like "thebusinessloanexpress.com" or siteurl like "thebusinessloanexpress.com" or domainname like "directcapitalpulse.com" or url like "directcapitalpulse.com" or siteurl like "directcapitalpulse.com" or domainname like "harboradvancefunding.com" or url like "harboradvancefunding.com" or siteurl like "harboradvancefunding.com" or domainname like "directcapitalboost.com" or url like "directcapitalboost.com" or siteurl like "directcapitalboost.com" or domainname like "guardianloccapital.com" or url like "guardianloccapital.com" or siteurl like "guardianloccapital.com" or domainname like "guardiancapitalway.com" or url like "guardiancapitalway.com" or siteurl like "guardiancapitalway.com" or domainname like "ourbusinessloans.com" or url like "ourbusinessloans.com" or siteurl like "ourbusinessloans.com" |
Reference:
https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/