Business Funding Phishing: The Form That Wants Your Revenue, Not Your Password

The email is addressed to your company by name. It says rates have dropped, that you may qualify, and that there is a window. If you have spent any time this year trying to get a line of credit, none of that reads as an attack. It reads like the thing you have been waiting for.

That is the entire design. And the part worth understanding is not how the email got into your inbox. It is what the page at the end of it asks you for, and why that turns out to be worth more to the sender than your password would have been.

Six tells in a funding offer

If one just landed and you want the short version, check these six. None of them depend on recognizing a technique, which matters because the techniques get replaced and these do not.

1. You did not apply. The SBA’s Office of Inspector General is direct: SBA communicates only from addresses ending @sba.gov, and anyone claiming to be SBA from anything else should be treated as fraud. Lenders answer applications. They do not open conversations.
2. The sender domain is a word salad. guardiangrowthfunding, digitalcapitalboost, advancefundingboost. Microsoft’s sample of 148 campaign domains was built from a vocabulary of 28 words, recombined and rotated. Read it out loud; if it sounds assembled rather than named, it was.
3. The amount arrives before the application does. A number and a timeline, with no knowledge of your books. The FTC’s rule: nobody legitimate promises a loan without knowing your credit history.
4. The first ask is information, not money. Revenue, amount wanted, credit score, role, tenure. That is not an application. It is a profile.
5. There is a logo doing work a logo cannot do. SBA OIG says it plainly: an SBA logo on a page does not mean SBA endorsed anything on it.
6. The exit is a phone number. Submit the form and the page thanks you, then suggests calling for a faster response. That is not service. It is the handoff to the part of the operation that works on people.

What the form actually asks for

The security vendor Fortra documented this operation in detail. Its September 2025 analysis is a year old now, and it remains the clearest account of what happens after the click — Microsoft’s 2026 research connects the campaign it was still tracking back to exactly this one.

The lure impersonates the SBA’s line-of-credit programs. Subject lines run off a handful of templates with the company name dropped in: Good News, <Company> — SBA Rates are Down!, Limited Window: Lower SBA Rates for <Company>. One batch leaked part of its own automation, exposing the %company% parameter being filled per recipient.

Click, and the page was generated for the occasion. Fortra found them AI-produced: one template, different branding, layout and stock faces each time, hosted on reputable infrastructure so the domain reputation looks ordinary. Almost nothing on the page works. Navigation is inert, and every button leads back to the single live element, which is a questionnaire asking for:

• Your company’s gross revenue
• The loan amount you want
• Your personal credit score
• Your role in the company
• How long you have been with the business
• Business name, your name, your email address

Then a pop-up thanks you, says someone will be in touch, and offers a number to call for a faster response.

Figure 01 · Four steps, and the last one is the product ScamDrill

Sender-domain and relay detail per Microsoft Security Research, 3 September 2026. Landing page and questionnaire fields per Fortra Intelligence and Research Experts, 18 September 2025, documenting the earlier phase of the same campaign.

Why a profile is worse than a password

Fortra’s assessment of the objective is the sentence to put in front of anyone who thinks their filter settled this: the operation is not after an immediate credential or payment. It is harvesting detailed business and financial information to enable highly targeted spear-phishing later.

We have written that follow-up from the other end. A vendor-impersonation email that already knows your payment terms is not guesswork. This campaign is the reading somebody did first.

Why it arrived looking legitimate

Nothing in this campaign is spoofed, which tends to surprise people who have spent money on email authentication.

The mail was relayed through infrastructure associated with ActiveCampaign, a real and widely used email-marketing platform. So SPF, DKIM and DMARC pass, because the platform genuinely is sending on behalf of a domain the operator genuinely controls. IP reputation reads as marketing traffic. And every link is rewritten to the platform’s own click-tracking domains, so the URL your user hovers over does not point at the strange finance domain at all.

Microsoft shared its findings with ActiveCampaign before publishing. The company says it tested the technique against its content moderation, that messages containing invisible Unicode get the same verdicts as their unobfuscated equivalents, and that heavy use of it is itself treated as suspicious. That is a reasonable answer, and it does not change the structural problem Microsoft states carefully: with any shared sending service, abuse of customer accounts complicates reputation-based filtering, because the activity looks like legitimate marketing traffic.

Worth sitting with, if your defensive story is mostly authentication. DMARC tells you a message really came from where it says. It does not tell you the sender is honest — the same point as device-code phishing on Microsoft 365, where every step is a genuine Microsoft flow doing what it was designed to do.

The invisible character, and why it is a footnote

This campaign got written up in September for a detail that turns out to be the least important thing about it, and it is worth knowing because it tells you something about where your defenses actually sit.

Microsoft’s researchers found the operator wedging invisible Unicode characters into the middle of finance words. funding was sent as fun⟨U+E0020⟩ding. To you it still reads as funding. To a detector matching the literal string, the word is not there. The technique is called ASCII smuggling, and it became well known through AI prompt-injection research, where invisible characters from the deprecated Unicode Tags block (U+E0000 to U+E007F) are used to hide instructions from a human while leaving them visible to a model. Here the intent is inverted: nothing is hidden from you, only from the filter.

It did not work. Microsoft reports that over 99% of these messages were flagged anyway, by layers that never looked at those characters — sender and URL reputation, machine-learning classification, brand-impersonation detection, authentication checks. And because tag characters are almost absent from ordinary mail, using them handed defenders a low-false-positive signal. The evasion was a flare.

The dates bound the technique, not the campaign. Microsoft’s signature went from firing on ~21,000 messages on 8 February 2026 to more than 1.3 million the next day, ran on a strict weekday-on, weekend-off schedule through a high-volume phase, and dropped off after 15 May. The operation ran before the Unicode characters appeared and carried on after they stopped. The trick came and went. The business did not — which is the argument for spending your attention on the form rather than the encoding.

A business looking for money has already lowered the drawbridge

Every phishing control your team has been trained on assumes the message is unwelcome. Nobody wants a password reset they did not request, or an invoice from a supplier they have never used. The training works partly because the email is an intrusion.

A funding offer is not an intrusion if you are looking for funding. Fortra makes exactly this point about why the SBA programs were chosen: they appeal to businesses seeking funding and the promise of financial relief, which can override normal caution — and smaller firms run with less defensive budget, which is why they get picked.

So the failure here is not really a filter failure. Most small businesses have no process for an inbound offer of good news. There is a callback rule for payment changes, probably a rule about wire requests from the owner, and almost never a rule that says we do not give financial details to a lender who contacted us first. That category does not exist, because it never looked like a threat category.

Four rules that survive any version of this

Figure 02 · None of these care how the email was encoded ScamDrill

Rules derived from SBA Office of Inspector General guidance on loan and phishing fraud, and FTC consumer guidance on advance-fee loans. Both are cited in full above.

All four are process rather than technology, which is the honest summary of this whole story. The last one — verifying through a channel the other party did not choose — is the same muscle that catches the fake help desk and the fake bank fraud department, and it is worth rehearsing precisely because it feels rude in the moment.

What the IT side should change

If you have an internal IT person or an MSP, Microsoft’s guidance reduces to one sentence that generalizes well past this campaign: normalize before you match.

One caution on indicators: the marketing platform’s tracking domains and sending IP range are shared with every legitimate customer of that platform, and Microsoft says plainly that the network block is not an indicator of compromise on its own. Use those to scope an investigation; do not block them.

If someone on your team already filled it in

No password was taken and no malware ran, so there is nothing to clean up in the usual sense. What was taken is a profile, and the response is about what happens next.

1. Write down exactly what was entered. Revenue, requested amount, credit score, role, tenure, contact details. Every one of those is a fact the next attacker will use to sound informed.
2. Tell the finance function the specific lie to expect. Not “be careful of phishing.” Tell them a call or email is likely coming that will correctly reference an application for roughly that amount, and that its purpose is to move money or collect banking details.
3. Treat any inbound call about the application as hostile. The questionnaire ends by inviting a call. Anyone ringing about it did not get your number from a lender.
4. Do not pay anything for a “faster” deposit. The advance-fee pattern the FTC describes shows up at exactly this stage: a processing, insurance or application fee payable before funds arrive.
5. If a credit score or Social Security number went in, treat it as an identity incident too and work that in parallel. The business profile and the personal one get sold to different buyers.
6. Report it. ReportFraud.ftc.gov, and if the lure used SBA branding, the SBA OIG Hotline.

If it turns out to be bigger than a form submission — credentials went in somewhere, or a payment moved — the sequencing matters more than the thoroughness, and we wrote the order to work in separately.

What to do now

Two things, both small. Ask whoever runs your mail filtering the normalization question and get an actual answer rather than a reassurance. And say the sentence out loud to whoever handles your money: we pick the lender, the lender does not pick us — then decide in advance who gets told when an unsolicited offer arrives.

If a link turns up and someone wants a second opinion, you can run the address through our free link checker. It will not resolve a marketing-platform tracking URL into a verdict on the business behind it, but it catches the cruder end of the range in seconds.

And if your team has never seen one of these under realistic conditions, the gap to close is not knowledge. Most people can list the red flags. The gap is that nobody has practiced the pause on a morning when the offer looks useful — which is the only morning it ever arrives.