Threat actors have adopted the ASCII smuggling technique in phishing campaigns, using invisible Unicode characters to evade email security filters.
ASCII smuggling has been used in AI prompt injection attacks to conceal malicious instructions from users by encoding them with Unicode characters from the Tags block (U+E0000–U+E007F).
Microsoft threat researchers discovered a large-scale phishing campaign using this technique, which peaked at up to 2.37 million daily messages in late February. Although the volume has dropped gradually in May, the operation is still active.
“The high-volume phase persisted for roughly three months after February 9 and dropped sharply after May 15, 2026,” explains Microsoft.
“These dates bound the observed use of the specific technique in our telemetry, not the broader campaign, which started earlier without it and continued without it.”
In this campaign, the attacker inserts an invisible Unicode character inside finance-related lure words to split them.
In doing so, a keyword like ‘funding’ becomes something like ‘fun[invisible character]ding’ and evades email filters that rely on word lists to detect suspicious or malicious messages.
Microsoft says the method has been used in millions of finance-themed phishing messages and works as intended, although Defender still caught over 99% of the messages based on other signals (sender, IP, domain, reputation checks).
On February 9, Microsoft identified a cluster of 148 finance-themed sender domains powering this campaign, accounting for about 96% of all messages its new Defender for Office 365 hunting logic flagged for Unicode-tag signatures.
The domains used words such as “funding,” “capital,” “loan,” “advance,” and “credit,” and the messages promoted business funding, loans, and credit services.
The messages were delivered through infrastructure associated with the legitimate ActiveCampaign email-marketing platform.
After receiving Microsoft’s report of service abuse, ActiveCampaign said its moderation systems detect invisible Unicode characters the same way they detect unobfuscated text and treat heavy use as suspicious.
Microsoft recommends that defenders strip or normalize Unicode tag characters and other invisible code points before applying keyword, regex, or signature-based detection, and treat unexpected tag-block characters as a strong anomaly.
Applying the same normalization before passing email content to AI assistants should mitigate the risk of prompt-injection attacks.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report
Post a Comment Community Rules
You need to login in order to post a comment
Not a member yet? Register Now