Analysis · curated 27 Sep 2026
Invisible Unicode Phishing: Hidden Text, Real Risk
First reported hackwednesday.com
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
ASCII smuggling with invisible Unicode characters is the same primitive used to hide malicious instructions from LLMs and AI agents, so defenders must normalize and inspect text before it reaches both email filters and AI systems that could otherwise act on concealed content.
HackWednesday explains ASCII smuggling — the insertion of invisible Unicode tag characters (e.g. U+E0020, TAG SPACE) inside words — drawing on Microsoft's September 3, 2026 research showing the technique crossing over from AI prompt injection into phishing filter evasion. Microsoft recorded roughly 2.37 million matching messages at a February 26, 2026 peak, where the hidden character interrupts financial keywords to evade literal string matching, though other protection layers flagged over 99% of messages.