A massive phishing campaign is using invisible Unicode tag characters to evade security filters, according to researchers at Microsoft. This technique, known as “ASCII smuggling,” has grown popular over the past year for launching AI prompt injection attacks, but the same tactic can hide suspicious text in emails.
“Because tag characters are invisible to humans but exist at the text-processing level, the same property that makes them useful for smuggling instructions into a model also makes them useful for obfuscating keywords before a detector evaluates them,” Microsoft explains. “The intent is inverted, but the mechanism is similar, and a user’s suspicions are not raised.”
In the attacks observed by Microsoft, the threat actors inserted invisible tag characters into common financial keywords such as “funding” in the phishing emails. While the message looks normal to a human, an automated scanner designed to flag suspicious keywords won’t be able to read the text properly.
“To a recipient, and to parsing pipelines that drop or normalize these characters, the word still reads as ‘funding,’” Microsoft writes. “To a detector matching the literal string funding, or a regex that does not account for interleaved invisible code points, the byte sequence no longer contains the contiguous keyword. Whether real-world detectors behave that way depends on their normalization step, which is examined below. The bigger prize for the attacker, though, is not preventing the literal string matches; it is the ML- and NLP-based models that increasingly drive modern spam and phishing classification. Unless a filtering system takes a picture of a message and does OCR extraction over the visual image, it may miss this type of attack.”
Microsoft has the story: https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/
