Spammers Deploy ASCII Smuggling in Massive Phishing Campaign Hitting 2.37 Million Daily Emails

Once popular for attacking AI, ASCII smuggling is embraced by spammers

A clever technique used to hide malicious prompts in attacks on AI agents has been adopted by spammers to evade filters on email platforms that are designed to flag unwanted messages used in mass campaigns. The technique is broadly known as ASCII smuggling. It gained attention two years ago as a means of making a class of AI attack known as prompt injections more stealthy. Malicious instructions embedded into emails or other untrusted content to be processed by an LLM aren't written in ordinary text. Instead, they're rendered by a special range of unicode tags. For example, the tag point U+E0041 mirrors "A," and U+E0061 mirrors "a." No longer just for obscuring prompt injections The block of 128 tags mimic a portion of the American Standard Code for Information Interchange almost perfectly, with one major difference: the characters they encode are readable by computers but by design are almost completely invisible to humans. By expressing the malicious prompts in these tags, LLMs detect the instructions, but people reading the email never see them. There's much more about ASCII smuggling here. Earlier this year, Microsoft started seeing a massive increase in spam messages that used the technique. Beginning on one day in early February, the number of ASCII smuggling signatures detected by Microsoft Defender for Office spiked from roughly 21,000 per day to more than 1.3 million. Within four days, signature detections jumped to 2.5 million. The deluge persisted for months and then fell off sharply in mid May. "Because tag characters are invisible to humans but exist at the text-processing level, the same property that makes them useful for smuggling instructions into a model also makes them useful for obfuscating keywords before a detector evaluates them," Microsoft explained Thursday. "The intent is inverted, but the mechanism is similar, and a user's suspicions are not raised." Spammers are embedding the unicode in an attempt to evade filters that search for text, such as dollar amounts and the words "credit" and "term" that are commonly found in their mass emails. By sprinkling the invisible text into the middle of the word "funding," for example, filters may read the words "fun" and "ding" instead. The receiver, meanwhile, sees the word "funding." Using special text to camouflage certain trigger words isn't new. Spammers have used zero-width spaces and non-breaking spaces for decades to achieve similar results. The characters can thwart searches matching a literal string and alter the byte sequence that regex filners hunt for. The spammers likely adopted the hidden unicode tags because some spam filters had yet to be programmed to detect them. A bigger likely reason for its use is to counteract the advantages made possible by machine learning (ML) and natural language processing (NL) LLMs for use in spam detection. Microsoft explained: The bigger prize for the attacker, though, is not preventing the literal string matches; it is the ML- and NLP-based models that increasingly drive modern spam and phishing classification. Unless a filtering system takes a picture of a message and does OCR extraction over the visual image, it may miss this type of attack. A standard email classifier may not reason over whole words exactly as a human sees them; for efficiency, they can first split text into tokens or sub-word pieces. A clean lure term such as funding may be represented as a familiar token or a familiar sequence of sub-tokens. Insert an invisible U+E0020 into the middle, however, and the tokenizer may no longer see that same familiar unit. It might split the text into fun, an unexpected tag character, and ding; it might emit rare or unknown sub-tokens; or, if normalization runs first, it simply removes the U+E0020 character, leaving funding. Thursday's post provided guidance on ways developers can program filters to better account for ASCII smuggling in spam.

ASCII smuggling isn't just an AI security risk

Fraudsters have found a new use for ASCII smuggling, typically used to hide malicious prompts intended for AI models, in an old-school attack method: email phishing. Microsoft uncovered a massive phishing campaign using invisible Unicode tag characters that peaked at more than 2.37 million messages in late February, remained elevated during weekdays over the next three months, and gradually declined by mid-June. "As AI-era attack methods become better understood, threat actors may adapt them for use in more traditional threats such as phishing and spam," Redmond's researchers Noam Kochavi and Sarah Wolstencroft said in a Thursday blog. "This case illustrates how techniques that emerge in AI security research can quickly cross over into established attack ecosystems, reinforcing the need for defenders to view emerging threats through a cross-domain lens." ASCII smuggling involves using invisible or non-rendering Unicode characters to hide content inside text that appears normal to humans, and this makes it a popular technique for indirect prompt injection attacks. In these, an attacker hides instructions for an AI assistant in invisible Unicode characters, and embeds those malicious prompts inside a webpage or document. A human can't see them, but a model can, and it decodes them as text - and may then follow the attacker's instructions to leak data or take unauthorized actions. Instead of using ASCII smuggling for prompt injection, however, Microsoft's security team spotted someone using invisible characters - inserting Unicode tag spaces between letters - to split financial-lure words in phishing emails in an apparent attempt to evade keyword matching and other content filters. So, for example, instead of writing "funding" in the email, the attackers wrote "fun⟨U+E0020⟩ding." "When we looked at a sampling of the flagged messages, the surprise was there were no smuggled instructions to an AI assistant," Kochavi and Wolstencroft wrote. "Instead, the invisible tag characters were inserted inside common financial keywords, splitting them apart so that a literal signature or keyword match would fail." Redmond first detected the ASCII-smuggling signature in early February, flagging about 21,000 messages on February 8 before the number skyrocketed to more than 1.3 million the next day. Most of these emails came from about 150 finance-themed sender domains, and they continued for the next three months, dropping sharply after May 15 but continuing with occasional smaller spikes through at least mid-June. The security researchers pointed out two notable characteristics, including sending massive numbers of emails on weekdays and then going silent over the weekend. The campaign also had a long, gradual decline. "After an intense first phase, with weekday volumes of 1 to 2.37 million messages, peaking on February 26, the numbers stepped down slowly to roughly 80 percent less per weekday by late March." It then dropped significantly after May 15, continuing with lower activity through mid-June. According to Redmond, the most important thing defenders can do to protect against Unicode tag blocks in phishing emails is to verify that normalization and tokenization pipelines handle tag characters consistently. "Any content that will be evaluated by keyword, signature, or regex logic should first have invisible and non-rendering Unicode code points stripped or folded, so that splicing them into a word no longer defeats the match," the threat hunters wrote. This same control can also help reduce the threat of ASCII-smuggling against AI assistants that ingest email content. Microsoft also suggests scanning for behavioral indicators. "The observed activity had a distinctive shape: bulk volume from churning, finance-themed disposable domains, on a strict weekday-on / weekend-off schedule," Kochavi and Wolstencroft warned. "A sudden spike of tag-block characters concentrated on finance-themed senders, switching on and off weekly, is a high-confidence campaign indicator." ®

Attackers conceal phishing lures using invisible Unicode characters

Threat actors have adopted the ASCII smuggling technique in phishing campaigns, using invisible Unicode characters to evade email security filters. ASCII smuggling has been used in AI prompt injection attacks to conceal malicious instructions from users by encoding them with Unicode characters from the Tags block (U+E0000-U+E007F). Microsoft threat researchers discovered a large-scale phishing campaign using this technique, which peaked at up to 2.37 million daily messages in late February. Although the volume has dropped gradually in May, the operation is still active. "The high-volume phase persisted for roughly three months after February 9 and dropped sharply after May 15, 2026," explains Microsoft. "These dates bound the observed use of the specific technique in our telemetry, not the broader campaign, which started earlier without it and continued without it." In this campaign, the attacker inserts an invisible Unicode character inside finance-related lure words to split them. In doing so, a keyword like 'funding' becomes something like 'fun[invisible character]ding' and evades email filters that rely on word lists to detect suspicious or malicious messages. Microsoft says the method has been used in millions of finance-themed phishing messages and works as intended, although Defender still caught over 99% of the messages based on other signals (sender, IP, domain, reputation checks). On February 9, Microsoft identified a cluster of 148 finance-themed sender domains powering this campaign, accounting for about 96% of all messages its new Defender for Office 365 hunting logic flagged for Unicode-tag signatures. The domains used words such as "funding," "capital," "loan," "advance," and "credit," and the messages promoted business funding, loans, and credit services. The messages were delivered through infrastructure associated with the legitimate ActiveCampaign email-marketing platform. After receiving Microsoft's report of service abuse, ActiveCampaign said its moderation systems detect invisible Unicode characters the same way they detect unobfuscated text and treat heavy use as suspicious. Microsoft recommends that defenders strip or normalize Unicode tag characters and other invisible code points before applying keyword, regex, or signature-based detection, and treat unexpected tag-block characters as a strong anomaly. Applying the same normalization before passing email content to AI assistants should mitigate the risk of prompt-injection attacks.

Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters

Microsoft is alerting of a "high-volume phishing campaign" that's using invisible Unicode tag characters to bypass email filters. "Instead of using these characters to hide instructions from people while exposing them to AI models, the attacker used them to split financial lure words such as 'funding' to prevent email filters from parsing them," the Microsoft Security Research team said. The Windows maker said the findings show AI-era evasion techniques can be adapted by threat actors in traditional phishing and spam campaigns. Attacks exploiting this approach are said to have first emerged in early February 2026. ASCII Smuggling refers to a technique where invisible or non-rendering Unicode characters are used to conceal messages or instructions inside seemingly-harmless text. As a result, human user interfaces do not render them, making the text appear completely normal to the user. However, such content can be ingested by email filters or AI language models, mistakenly treating it as real text. This, in turn, can open the door to prompt injection by taking advantage of the fact that large language models (LLMs) cannot draw a reliable boundary between genuine user instructions entered directly into a prompt and content embedded into benign-looking text or other third-party sources such as web pages, documents, or emails. "The most abused range is the Unicode Tags block, U+E0000 to U+E007F," Microsoft said. "This block contains a shadow copy of the printable ASCII characters (for example, U+E0041 mirrors 'A,' U+E0061 mirrors 'a'). The block was originally intended for language tagging and is now largely deprecated." According to the Windows maker, the ASCII smuggling-oriented phishing campaign entered into a high-volume phase for roughly three months before dropping sharply post May 15, 2026. The activity is said to have followed a weekly cadence, with the campaign almost going radio silent on weekends and resuming in full swing on Mondays. Weekday volumes are estimated to reach anywhere between 1 to 2.37 million messages, hitting a peak on February 26, 2026. The campaign is assessed to be tied to a broader phishing campaign that weaponized the ActiveCampaign marketing and automation platform to distribute thousands of AI-generated phishing emails targeting Small Business Administration (SBA) loan applicants. Details of the phishing campaign were disclosed by the Fortra Intelligence and Research Experts (FIRE) team in September 2025, stating the operation focuses on collecting detailed business and financial information, likely to enable highly targeted spear‑phishing in future attacks. "The campaign's sophistication and uniqueness lies in the ability to mass‑produce convincing, tailored websites that adapt to different illegitimate or impersonated domains," Fortra noted at the time. "Threat actors are able to scale sophisticated phishing by using ActiveCampaign's AI-powered marketing automation features to vary the design, content, and flow, ultimately creating more convincing phishing campaigns, quicker." The latest set of phishing emails, per Microsoft, leverages the invisible tag characters as an obfuscation pattern, inserting them inside common financial keywords so as to split them apart and get around email filters looking for keyword or literal signature matches. For instance, a finance-related lure term such as "funding" becomes "fun⟨U+E0020⟩ding," so that it looks normal to the email recipient while having the side effect of bypassing email security controls. "To a recipient, and to parsing pipelines that drop or normalize these characters, the word still reads as funding," Microsoft explained. "To a detector matching the literal string funding, or a regex that does not account for interleaved invisible code points, the byte sequence no longer contains the contiguous keyword." While the use of invisible or look-alike characters is not a new technique in phishing and homoglyph attacks, what's novel is the choice of the characters used - namely, the Unicode Tags block - and the scale of the campaign itself, which has generated multi-million messages on a daily basis. The campaign has been found to leverage hundreds of disposable, finance-themed sender domains using lures that mimicked business loan, line-of-credit, and advance-funding phishing patterns that are typically associated with fraud or credential-harvesting schemes. The top 10 sender domains by the most hits are listed below - * guardiangrowthfunding[.]com * digitalcapitalboost[.]com * thebusinessloanexpress[.]com * yourlocfunding[.]com * advancefundingboost[.]com * guardiancapitalway[.]com * harboradvancefunding[.]com * unitedfundingwave[.]com * directcapitalboost[.]com * onlinedirectfinance[.]com What's more, these emails from these finance-themed domains are relayed through ActiveCampaign, causing every outbound link in the message body to be routed via its own click-tracking domains ("acemlnd[.]com" and "activehosted[.]com"). ActiveCampaign, for its part, said it has tested its content-moderation systems with messages containing invisible Unicode characters, and that such emails receive the moderation verdict as their unobfuscated equivalents. It also said a heavy use of the technique is treated as a "suspicious signal." "As with any shared sending service, attacker abuse of customer accounts or workflows can complicate reputation-based filtering," Microsoft said. "By originating from a reputable marketing platform with established IP reputation and authentication, the activity may appear more similar to legitimate marketing traffic and can complicate reputation-based filtering."

ASCII smuggling crossed over from AI attacks to spam

Invisible Unicode characters became famous for hiding instructions from people while feeding them to AI models. Microsoft has found a phishing operation using them for something duller: splitting the word funding so filters miss it. The ASCII smuggling campaign hit 2.37 million messages a weekday, and it failed. For two years, invisible Unicode characters have been the neat trick of AI security research. You hide instructions inside them. A person sees nothing. A language model reads them and does as it is told. Microsoft has now found somebody using the same characters for something far less clever. They were splitting up the word "funding" in spam. Noam Kochavi and Sarah Wolstencroft of Microsoft Security Research published the finding in a blog post on Thursday. At its height the campaign pushed millions of messages a weekday. The block of characters nobody wanted The technique is called ASCII smuggling. It uses the Unicode Tags block, U+E0000 to U+E007F. That block holds an invisible shadow copy of the printable ASCII characters. U+E0041 mirrors a capital A. U+E0061 mirrors a lowercase one. Unicode created the block for language tagging, then abandoned the idea. A later plan to use it for regional flags mostly failed too. The characters sat there, readable by software and invisible to people, until AI researchers noticed what that combination allows. That is the prompt injection version. Hide instructions in tag characters. Embed them in a page or a document. An assistant that ingests the raw text may then follow them. TNW has covered several. One hidden line in a Word document could rewrite figures in a spreadsheet and infect the next file. In September a researcher hijacked Claude Code by asking it to summarise a web page. Another team fed an OpenClaw agent a phishing email and got it to leak AWS keys. In every case the trick is the same. The machine reads something the person cannot see. What this campaign did instead Microsoft built a hunting signature for exactly that, looking for tag characters in email. When the alerts spiked, the team pulled a sample and found no hidden instructions at all. The invisible characters sat inside ordinary words. One tag space went into the middle of a financial lure term. So "funding" travelled as "fun", an invisible character, then "ding". The recipient sees funding. A filter matching the literal string does not. Keyword matching is the smaller prize. Modern spam classifiers run on machine learning, and those split text into tokens before they reason about it. Insert one invisible character and a familiar token can become two unfamiliar fragments. Or a rare sub-token the model has barely seen. "The intent is inverted, but the mechanism is similar, and a user's suspicions are not raised," Microsoft wrote. It did not work This is the part the campaign's scale obscures. The evasion failed. More than 99% of the messages were caught by layers that had nothing to do with the invisible characters, according to Microsoft. Sender and IP reputation, URL and domain checks, brand impersonation detection, authentication, and the classifiers themselves all fired. Defender also photographs message content and reads the text back with OCR, which sees what a human sees. There is a second problem for the attacker. Tag characters are so rare in ordinary email that using them is a beacon. Microsoft says their presence is now a high-confidence indicator, which turns an evasion technique into a detection one. The first version of the signature had exactly one false-positive problem, and it is a good one. It kept firing on legitimate mail containing the flags of England, Scotland and Wales. Those three emojis are built from invisible tag characters. The numbers, and where they disagree On 8 February the signature fired on roughly 21,000 messages. The next day it fired on more than 1.3 million. Weekday volumes then ran between 1 and 2.37 million messages for about three months. Traffic collapsed to near zero every Sunday and returned on Monday. That is the rhythm of scheduled bulk-sending infrastructure rather than of anything human. Volumes fell roughly 80% per weekday by late March, dropped sharply after 15 May, and left a residue into mid-June. Microsoft's own post gives two different peak dates. A chart caption puts the high above 2.3 million on 11 February. The text three sections later says the peak was 26 February. Ars Technica reported detections reaching 2.5 million within four days of onset, which matches neither. The shape of the campaign is not in doubt. The single highest day is. 148 domains built from 28 words The mail came from about 150 disposable, finance-themed sender domains. On 9 February alone there were 148 of them, and they are assembled from a vocabulary of 28 words. Advance, boost, business, capital, catalyst, choice, digital, direct, elevate, express, finance, funding, growth, guardian, harbor, loan, loans, loc, online, our, pulse, rocket, rush, the, united, wave, way and your. Recombine those and you get guardiangrowthfunding, digitalcapitalboost, advancefundingboost and 145 more. The busiest took 30,442 hits in a day. None of them actually sent the mail. The campaign relayed it through ActiveCampaign, a legitimate marketing platform, which rewrites every link to route through its own tracking domains. About 92% of the volume came from a single network block belonging to that platform. Borrowing a real platform's reputation is now standard practice. Google sued a Chinese operation in June that used Gemini to build phishing sites and send 2.5 million scam texts. Volume is cheap. Trusted infrastructure is scarce. ActiveCampaign told Microsoft it had tested the technique against its own moderation systems. Obfuscated messages get the same verdicts as clean ones, the company said. It also treats heavy use of invisible characters as a suspicious signal in its own right. The Unicode phase was one chapter of something longer. Fortra documented the wider operation in September 2025, when it was using the same platform to send AI-generated phishing aimed at Small Business Administration loan applicants. That campaign ran before the tag characters appeared and continued after they stopped. Normalise before you match Microsoft's advice is one line. Strip or fold invisible code points out of subject and body text before any keyword, signature or regex logic looks at them. The same control cuts both ways, which is the point of the whole episode. Cleaning tag characters out of email before a filter sees them also cleans them out before an AI assistant reads the inbox. OpenAI took a blunter route in June and gave ChatGPT a Lockdown Mode for the same class of attack. The crossover is the lesson The Register drew from it too. Techniques do not stay in the domain that made them famous. This one took about a year to travel from red-team write-ups to bulk email, and it arrived without the part that made it interesting.