Unicode-based “ASCII smuggling” technique appears in large phishing campaign

Microsoft says attackers have adapted a technique associated with AI prompt-injection research for use in conventional phishing campaigns, inserting invisible Unicode characters into email text to evade some content-based detections.

The company reported that the activity used Unicode tag characters placed inside financial-themed terms. The characters do not normally appear when a recipient views the message, but they can split a word at the code-point level. For example, a phishing email could visually display a term such as “funding” while including an invisible character between portions of the word, potentially preventing a simple keyword, signature or regular-expression match from recognizing it.

High-volume activity

Microsoft researchers said they first observed the signature in early February. Detection volume rose from roughly 21,000 messages on February 8 to more than 1.3 million the following day, later reaching a peak of more than 2.37 million messages in late February. The campaign remained active during weekdays for several months before declining significantly after mid-May, with smaller bursts continuing into mid-June.

Most messages were reportedly sent from around 150 finance-themed domains. The weekday-heavy distribution and gradual reduction in volume were among the behavioral patterns identified by Microsoft.

From AI security research to email abuse

ASCII smuggling generally refers to hiding content in text through invisible or non-rendering characters. In AI-related attacks, such characters can conceal instructions that may be processed by an automated assistant even though they are not visible to a human reader. In the phishing operation described by Microsoft, however, the hidden characters were used to fragment terms rather than to embed prompts for an AI system.

The finding illustrates that methods initially discussed in the context of generative AI can be repurposed for established threats such as spam and credential phishing.

Defensive measures

• Normalize email text before applying keyword, signature and regex-based checks.
• Strip or consistently fold invisible and non-rendering Unicode code points during analysis.
• Monitor for unusual concentrations of Unicode tag characters in inbound email.
• Correlate text anomalies with sender-domain churn, financial lures and recurring weekday delivery patterns.

Microsoft noted that stronger text normalization may also reduce risks for AI assistants that process email or other untrusted content.