News
ASCII smuggling crosses over from AI prompt injection to phishing evasion | Microsoft Security Blog
Publication date not yet evaluated · Added · 8 reports microsoft.com
Page published · Page updated
Coverage timeline
Why it matters
ASCII smuggling shows how invisible-Unicode techniques born in AI prompt-injection research migrate into traditional attack ecosystems like phishing, reinforcing the need for defenders to strip and detect non-rendering Unicode across both AI and email pipelines.
Microsoft researchers Noam Kochavi and Sarah Wolstencroft reported that ASCII smuggling — hiding content in invisible Unicode tag characters, a technique popularized for indirect prompt injection against LLMs — has been repurposed in a large phishing campaign that peaked at over 2.37 million messages in late February. Rather than smuggling instructions to an AI assistant, attackers inserted invisible Unicode tag spaces between letters of financial-lure words (e.g. 'fun⟨U+E0020⟩ding') to evade keyword matching and content filters.
Summary
Microsoft's security team identified a large-scale email phishing campaign that repurposed ASCII smuggling — a technique previously seen in AI indirect prompt injection — to evade content filters. Rather than hiding instructions for an AI model, the operators inserted invisible Unicode tag characters inside common financial keywords to break literal keyword and signature matches.[0]
The campaign was high volume, peaking at more than 2.37 million messages on February 26 after an initial surge from about 21,000 flagged messages on February 8 to over 1.3 million the next day. Traffic came from roughly 150 finance-themed sender domains, ran on a strict weekday-on/weekend-off schedule, and declined gradually before dropping sharply after May 15 and continuing with smaller spikes through mid-June.[0]
The case illustrates how methods that emerge in AI security research, such as smuggling data via the Tags Unicode Block, can cross over into established attack ecosystems like phishing and spam, reinforcing the need to view emerging threats through a cross-domain lens.[0][38]
Attack chain
- Keyword obfuscation: Attackers inserted invisible Unicode tag spaces (e.g., U+E0020) between letters inside common financial-lure keywords, splitting words like 'funding' into 'fun[U+E0020]ding' so that literal signature, keyword, and regex matching would fail while the text still rendered normally to human recipients.[0]
- Bulk distribution: The obfuscated phishing emails were sent in bulk from about 150 churning, finance-themed disposable sender domains on a strict weekday-on/weekend-off cadence, generating weekday volumes of 1 to 2.37 million messages during the initial phase.[0]
Disclosure timeline
| Date | Event |
|---|---|
| Early February 2026 | Microsoft first detects the ASCII-smuggling signature in email traffic.[0] |
| February 8, 2026 | About 21,000 messages flagged for the signature.[0] |
| February 9, 2026 | Volume skyrockets to more than 1.3 million messages.[0] |
| February 26, 2026 | Campaign peaks with weekday volumes of up to 2.37 million messages.[0] |
| Late March 2026 | Weekday volumes step down to roughly 80 percent less than peak.[0] |
| After May 15, 2026 | Activity drops sharply, continuing with occasional smaller spikes.[0] |
| Mid-June 2026 | Campaign activity has largely tapered off.[0] |
| September 3, 2026 | Microsoft researchers Noam Kochavi and Sarah Wolstencroft publish their analysis of the campaign.[0] |
How it works
ASCII smuggling abuses the Tags Unicode Block, whose code points mirror ASCII but are typically not rendered in user interfaces, leaving the characters invisible to humans while still being processed by text-handling systems and tokenizers. In this campaign the operators inserted invisible tag spaces between letters of financial keywords, so a value such as 'funding' becomes 'fun[U+E0020]ding' — visually identical to a human reader but a different byte sequence that defeats literal signature and keyword filters.[0][38]
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| other | U+E0020 (Unicode tag space) inserted within financial keywords | Invisible Unicode tag characters spliced between letters of common finance-themed words to evade keyword and signature matching; a sudden spike of tag-block characters concentrated on finance-themed senders is described as a high-confidence campaign indicator.[0] |
| other | ~150 finance-themed disposable/churning sender domains | Bulk email volume originated from roughly 150 finance-themed disposable domains sending on a strict weekday-on/weekend-off schedule.[0] |
Key takeaways
- Techniques that emerge in AI security research, such as smuggling data through invisible Unicode tag characters, can rapidly be repurposed by traditional attackers for phishing and spam, so defenders should evaluate emerging threats through a cross-domain lens.[0][38]
- Content-filtering pipelines must consistently strip or fold non-rendering Unicode before applying keyword, signature, or regex logic, since otherwise invisible characters can silently defeat detection.[0]
Defensive actions
- Normalize and strip or fold invisible and non-rendering Unicode code points before content is evaluated by keyword, signature, or regex logic.: Ensuring normalization and tokenization pipelines handle tag characters consistently prevents splicing invisible characters into words from defeating keyword and signature matches, and also reduces ASCII-smuggling risk against AI assistants that ingest email content.[0]
- Scan for the campaign's behavioral signature — bulk volume from churning finance-themed disposable domains on a weekday-on/weekend-off schedule with concentrated tag-block characters.: Microsoft describes this distinctive shape as a high-confidence campaign indicator that can be detected behaviorally even when individual message content is obfuscated.[0]