ASCII smuggling phishing campaign used invisible Unicode to evade filters
Microsoft found finance-themed phishing emails using invisible Unicode tags to disrupt filtering, repurposing a technique known from AI attacks.
By Hana Yoshida · Markets Reporter
3 min read
Microsoft says it identified an ASCII smuggling phishing campaign that used invisible Unicode characters in finance-themed emails to interfere with spam filtering. The activity shows how a technique associated with AI prompt injection can also be used to conceal words from automated email defenses while leaving messages looking normal to recipients.
Microsoft's tuned hunting signature for the technique rose sharply on February 9, 2026, and stayed elevated on weekdays for about three months. The company said most of the messages it observed were caught by layered protections, rather than by a single detection for the Unicode characters.
What is ASCII smuggling in phishing emails?
ASCII smuggling inserts mostly non-rendering characters from Unicode's Tags block, U+E0000 through U+E007F, into text. Microsoft says the block contains counterparts to printable ASCII characters and was intended for language tagging, but is now largely deprecated.
Typical fonts and email interfaces do not display most of those characters. A person may therefore see an ordinary word, while software processing the message's raw text receives extra characters embedded within it.
In the campaign, Microsoft said attackers placed the characters inside financial lure terms including “funding.” The recipient would see “funding,” but a filter could process separated pieces such as “fun” and “ding,” potentially defeating a literal keyword match or changing how a classifier interprets the text.
How the tactic moved from AI attacks to spam
ASCII smuggling gained attention in AI security because hidden text in an email, document or web page can be read by an AI system that receives the raw content even though a human cannot see it. In that setting, the concealed text can contain instructions aimed at influencing an AI assistant, Microsoft said.
The phishing use reverses the immediate target. Instead of hiding instructions for a model, the sender hides or breaks up visible lure words before a detector evaluates them. Ars Technica reported that Microsoft Defender for Office signature detections climbed from roughly 21,000 a day to more than 1.3 million in early February and reached 2.5 million within four days. Those figures reflect a Microsoft hunting signature, not a count of all spam or phishing messages globally.
Why email filters can be affected
Traditional filters may look for exact strings or regular-expression patterns, both of which can be disrupted by invisible characters in the middle of a word. Microsoft also said machine-learning and natural-language-processing systems can split text into tokens or smaller units; an inserted tag can change those units unless a system normalizes the text first and removes the character.
Defenders cannot treat every character in the Tags block as malicious. Microsoft said an early signature that flagged any such character also caught legitimate subdivision flag emoji for England, Scotland and Wales, which use tag-character sequences. The company advises using the block as a hunting starting point, then adding Unicode context and exclusions to limit false positives.
This story draws on original reporting from Ars Technica.