The payload in the Defender for Office 365 campaign carries no instruction. It is a word break. Put U+E0020 between "fun" and "ding" and a person still reads "funding" while a filter looking for that string finds nothing to match [5][4]. Nothing has to be interpreted for the evasion to land, which is why Microsoft says it works against spam filters and ML-based classifiers alike [3].
That is where the two accounts pull apart. The dev.to writeup reads the campaign as the jailbreak primitive graduating into commodity abuse, and says plainly that the exact mechanics were not detailed in the reporting it saw [14][15]. The New Stack has the mechanics, and they are not injection: tag characters inside "funding", "loan" and "credit" so that exact matches fail, while recipients see ordinary business loan and credit offers [4][7]. The primitive travelled downstream while the objective changed on the way.
If your ingest path calls Unicode normalization and treats the result as sanitized, check what those forms promise. NFC and NFD reconcile different representations of the same character; they were not built to remove tag characters, and per The New Stack the tags survive both [8]. Deleting the U+E0000 to U+E007F range is a separate, explicit step [11]. Tokenizer behaviour after that is not uniform either, since some tokenizers ignore the tag and others resplit the surrounding text, so the only useful test is against the tokenizer you actually ship [9].
The volume figures come from Microsoft's own mail flow, and they count signature hits [6]. About 21,000 the day before the campaign to more than 1.3 million the next day is roughly a 62-fold jump [19]; past 2.3 million two days after that is about 110 times the pre-campaign day [20]. For that curve to mean anything in your environment, your mail path would need comparable exposure to this campaign and the signature would need to be specific. Microsoft's own experience argues for care on the second condition: the first version of the hunting signature matched the England, Scotland and Wales subdivision flag emojis, which are assembled from invisible tag sequences, until the team carved out an explicit exception [13]. A 21,000-hit baseline recorded before the campaign started is consistent with a signature that also fires on text nobody sent in anger.
One recommendation costs real work. Whatever you strip has to stay stripped for the rest of the pipeline, because comparing the original against a tag-free copy and then handing the untouched original to the model validates a string the model never reads [12]. A second design choice, from the dev.to piece that doubles as a pitch for a filter called Sentinel, is worth taking regardless of the pitch: obfuscation found during normalization adds to the threat score instead of being quietly cleaned and passed along [17][18]. Successful decoding is not a clean bill of health.
Mail providers have somewhere to fall back to when the words stop matching, including sender reputation, link analysis and header inspection [16]. An agent handed a support ticket has the text and not much else [10].
