Microsoft Finds Phishers Using Invisible Unicode to Dodge Email Filters

Microsoft has identified a phishing campaign that inserted invisible Unicode tag characters inside finance-related lure words, making messages appear normal to recipients while attempting to evade email content filters. The technique, known as ASCII smuggling, previously drew attention for concealing prompt-injection instructions from people while leaving them readable to AI systems.

The method exploits a mismatch in text processing. ASCII smuggling uses 128 Unicode tag characters that computers can read but people can barely see. An attacker can place one inside a visible word such as “funding,” leaving a recipient to read “funding” while a filter may split it into unfamiliar pieces rather than recognize the original term.

A normal-looking lure can become unrecognizable text

That can defeat more than a simple keyword blacklist. Email classifiers often turn text into tokens, or smaller word fragments, before scoring it. A hidden tag can cause a familiar lure to become rare or unknown fragments. Microsoft also warned that filters relying on text processing rather than rendering a message and extracting its visible text with optical character recognition may miss the obfuscation.

The underlying evasion idea predates the current AI discussion: spammers have long used zero-width and non-breaking spaces to disrupt literal text matching. What changed here is the adoption of Unicode tag characters that had been associated with indirect prompt injection, where hidden instructions are placed in documents or webpages for a large language model to process.

The volume suggests a campaign, not an isolated bypass

Microsoft Defender for Office saw signatures rise from roughly 21,000 a day to more than 1.3 million in early February; within four days, the company recorded 2.5 million daily detections. Most messages came from about 150 finance-themed sender domains. Activity ran mainly on weekdays, dropped sharply on weekends, then declined substantially after May 15 while continuing at lower levels through at least mid-June.

The figures describe detections of the signature, not a count of successful phishing attempts or recipient losses. They do, however, show that an obscuring method once framed as an AI-specific concern can operate at the volume and regular cadence of mass email campaigns.

The defensive fix begins before classification

Microsoft’s recommended control is to normalize text before evaluating keywords, signatures, or regular expressions: strip or fold invisible and non-rendering Unicode code points so inserted tags cannot split a lure word. It also advises defenders to ensure that normalization and tokenization handle those characters consistently, rather than treating them differently at separate stages of a filtering pipeline.

That remediation has a second use for organizations feeding inbound email into AI assistants. Microsoft says the same normalization and tokenization controls can reduce ASCII-smuggling exposure for those systems. The unresolved operational question is whether email-security and AI-assistant pipelines apply that cleanup before their models or rules interpret untrusted content.