Breaking

Microsoft Finds Phishing Campaign Using ASCII Smuggling to Split Keywords and Evade Email Filters

September 6, 2026 at 23:47 EDT

Security
AI Agents

Microsoft researchers say a high-volume phishing campaign used ASCII smuggling—an invisible-Unicode technique first popularized to hide prompt injections from people while exposing them to AI models—to split financial lure words and evade email filters. A hunting signature in Microsoft Defender for Office 365 jumped from about 21,000 hits on February 8, 2026, to more than 1.3 million the next day, with weekday volumes later reaching as high as 2.37 million messages.

Sept. 3, 2026 · Microsoft

ASCII smuggling leaves the lab for the inbox

Phishers inserted invisible Unicode tag characters into lure words such as funding. People still saw a normal pitch. Keyword filters saw broken fragments.

2.37M

Weekday peak messages in late February

99%+

Still caught by layered mailbox defenses

148

Finance-themed sender domains on Feb. 9

~80%

Weekday drop by late March

Overnight jump in Unicode-tag hits

Signature hits, Feb. 8 versus Feb. 9. Column height is proportional to the reported counts.

21,000

Feb. 8

1.3 million

Feb. 9

Takeaway: detections leapt from a low-thousands baseline to more than a million messages the next day.

How the split works

Write a lure word such as funding

→

Insert an invisible Tags-block character

→

Recipient still reads funding

→

Filter may see fun + ding

What still held

Layered checks—sender and IP reputation, URL and domain review, authentication, classifiers, and OCR of the visible message—still blocked more than 99% of the mail. Rare tag characters also became a detection signal.

Where it can still bite

Naive keyword matches and some tokenizers can miss a split word. AI assistants that ingest raw email have fewer extra signals than a full gateway, so the same splice can confuse a model pipeline.

Defender control

Strip invisible code points before anything reads the text

Fold or remove Tags-block characters (U+E0000 to U+E007F) and other zero-width marks before keyword, regex, or signature logic.
Apply the same cleanup before an AI assistant ingests mail, not only before spam scoring.
Treat unexpected tag characters as a high-confidence anomaly, with a narrow exception for regional flag sequences.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.