TechCapsules

Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters

Microsoft warned of a high‑volume phishing campaign nationwide that uses invisible Unicode tag characters to split financial lure words and evade email filters. The technique, known as ASCII smuggling, inserts non‑rendering code points from the deprecated Unicode Tags block (U+E0000‑U+E007F) into keywords such as “funding,” rendering them readable to users while breaking literal string matches used by security tools. The operation began in early February 2026, peaked on February 26 with 1‑2.37 million messages per day, and followed a weekly cadence that paused on weekends. Over three months it sent multi‑million daily emails before dropping sharply significantly after May 15. The campaign is linked to a broader effort that weaponized the ActiveCampaign platform to deliver AI‑generated, finance‑themed phishing targeting SBA loan applicants.

💡 By exploiting Unicode tags, attackers bypass conventional filters at scale, forcing security teams to redesign detection logic for invisible characters.

Excited to see early customers already using Astra on Azure!

Microsoft CEO Satya Nadella announced that early customers are already deploying Astra, the company’s GPT‑6‑based model, on Azure. The rollout marks the first integration of an OpenAI model classified in the “Critical” cybersecurity risk tier, indicating it can autonomously discover unknown vulnerabilities and construct exploit chains. Comments from industry observers highlighted a shift in focus from showcasing raw AI capabilities to addressing access‑control and credential‑scoping challenges for computer‑use agents. Analysts noted that the model’s advanced threat‑finding abilities raise both security concerns and potential use‑case opportunities for enterprises seeking automated vulnerability assessment. The announcement was shared on LinkedIn, accompanied by a link to the Azure offering and a series of reactions from tech professionals.

💡 Astra’s “Critical” risk rating forces cloud providers and enterprises to confront AI‑driven cyber threats head‑on, reshaping how security controls are built around generative models.

Smart Glasses Could Become a Powerful Tool for Extremists, Researcher Warns

Researcher James Paterson of the Lowy Institute warned that the rapid diffusion of inexpensive, camera‑equipped smart glasses could give violent extremists a new force multiplier. He compared the technology’s trajectory to drones and 3‑D printers, which moved from costly, government‑only tools to affordable devices used by militants. Meta currently dominates the market, while Google plans Android XR glasses for 2027 and Apple for 2028, and low‑cost models are already sold on sites such as Kmart and Amazon. Paterson said the devices enable hands‑free recording, target surveillance and AI‑assisted communication, making existing extremist tactics easier and less conspicuous. Australian public debate has focused on privacy, and the national security agency’s latest threat assessment omitted mention of smart‑glass misuse in its analysis.

💡 Covert, hands‑free surveillance lets extremists blend into crowds, stripping law‑enforcement of a visual edge in spotting hostile activity.

MicroScope: Securing an AI world

In the September 2026 issue of MicroScope, the editorial team examines how cybersecurity professionals are turning artificial intelligence against itself to mitigate emerging AI‑driven threats, describing the approach as a “game of two halves.” The feature by Billy MacInnes outlines the seismic shift AI has caused in threat detection, response automation, and adversarial attacks, emphasizing the need for continuous model training and robust data governance. A separate article by Simon Quicke reports HPE’s UK channel head’s plan to simplify partner engagements by stabilising hardware pricing under the company’s “Power of One” strategy, aiming to reduce cost volatility for customers adopting AI solutions. The issue also includes a five‑minute interview with Rob Lay, Cisco’s UK and Ireland CTO, offering his perspective on channel dynamics and AI integration.

💡 By showcasing AI as both a weapon and a shield, the piece highlights the urgent arms race that will define future cyber defenses, while HPE’s pricing reforms promise clearer budgeting for enterprises scaling AI workloads.

Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day

Google released a Chrome update on Thursday that patches 12 vulnerabilities, including the high‑severity CVE‑2026‑85046, a type‑confusion flaw in the V8 engine that allows remote code execution via crafted HTML. The bug, discovered by researcher Salvatore Gulizia on August 4, was actively exploited in the wild. Google’s fix targets Chrome versions 152.0.7977.82/83 for Windows and macOS, and 152.0.7977.82 for Linux, and urges users of other Chromium‑based browsers to apply the update. The patch is part of six zero‑day fixes issued this year.

💡 The update closes a critical flaw that could let attackers run arbitrary code inside Chrome’s sandbox, a core component of web security. By addressing this and other zero‑days, Google reduces the attack surface for millions of users worldwide.

Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

Wordfence reported that actors have launched over 440,000 exploit attempts against two WordPress plugin flaws – CVE‑2026‑14894 in Super Forms and CVE‑2026‑32475 in Elementor Pro. Both vulnerabilities allow file upload, enabling attackers to place a PHP web shell in the site’s uploads directory and execute code, create admin accounts, or exfiltrate data. Exploits of CVE‑2026‑14894 involve POST requests to /wp‑admin/admin‑ajax.php with a Base64‑encoded PHP payload disguised as an image, while CVE‑2026‑32475 attacks require a published Elementor page containing a Form widget with a File Upload field. Wordfence blocked roughly 250,000 attempts on Super Forms flaw and 190,000 on Elementor flaw. Campaigns began in July and peaked in August 2026. Site owners are urged to apply patches