A technique that became infamous as a way to attack AI models has jumped to a much bigger target: your spam folder. Microsoft's security team reports that email fraudsters spent months using "ASCII smuggling" — invisible Unicode characters that humans cannot see but machines can read — to slip millions of phishing emails past corporate spam filters, in one of the clearest cases yet of an AI-era attack method crossing over into conventional cybercrime.
According to The Register, Microsoft threat researchers Noam Kochavi and Sarah Wolstencroft described the campaign in a Thursday blog post. The operation peaked at more than 2.37 million messages in a single weekday in late February, then remained elevated on weekdays for roughly three months before gradually tapering off by mid-June. For more context on this story, see our ongoing AI news.
How ASCII Smuggling Works
ASCII smuggling exploits Unicode characters that are valid but non-rendering — most notably Unicode tag characters, a block originally designed for language tags. When inserted into a document, webpage, or email, they display as nothing at all. That invisibility made the technique a staple of indirect prompt injection attacks, in which an attacker hides instructions for an AI assistant inside invisible characters embedded in a webpage or document. A human reviewing the page sees nothing unusual, but an AI system ingesting the raw text can read and obey the hidden commands.
Security researchers have demonstrated the technique against major AI chatbots and email assistants, which is why it has been mostly discussed as an AI security problem. What Microsoft's team found was different: the hidden characters were not addressed to an AI at all.
"When we looked at a sampling of the flagged messages, the surprise was there were no smuggled instructions to an AI assistant," Kochavi and Wolstencroft wrote, according to The Register. "Instead, the invisible tag characters were inserted inside common financial keywords, splitting them apart so that a literal signature or keyword match would fail."
A Months-Long Finance-Lure Campaign
Microsoft first detected the signature in early February 2026, flagging roughly 21,000 suspicious messages on February 8. The next day, volume skyrocketed past 1.3 million. At its peak on February 26, the campaign sent more than 2.37 million messages in a single day, with most emails originating from about 150 finance-themed sender domains.
The operation ran with almost industrial discipline. Volumes surged on weekdays — between 1 million and 2.37 million messages per day — and went silent on weekends. After the intense first phase, daily weekday volumes stepped down by roughly 80 percent by late March, dropped sharply after May 15, and continued at lower levels with occasional smaller spikes through at least mid-June.
The lures were financial, and the obfuscation was simple but effective. Instead of writing a trigger word like "funding" in plain text, attackers inserted invisible tag spaces between letters — the researchers cite a Unicode tag space, U+E0020, spliced into the middle of words. To a human reader, the word looks perfectly normal. To a keyword filter, regex engine, or signature matcher, it is a string no blocklist will recognize.
Why Filters Failed and What Defenders Should Do
The campaign worked because so much email security still depends on literal text matching. Microsoft's core recommendation is that any content evaluated by keyword, signature, or regex logic should first have invisible and non-rendering Unicode code points stripped or folded, so that splicing them into a word no longer defeats the match. Verifying that normalization and tokenization pipelines handle tag characters consistently is, in the researchers' view, the single most important control.
That same fix carries a bonus for AI security: since ASCII smuggling against AI assistants depends on the same invisible characters surviving preprocessing, stripping them before content reaches a filter also reduces the risk of hidden prompt injection inside ingested email.
Microsoft also urges defenders to watch for behavioral indicators rather than raw keywords. "The observed activity had a distinctive shape: bulk volume from churning, finance-themed disposable domains, on a strict weekday-on / weekend-off schedule," the researchers wrote. "A sudden spike of tag-block characters concentrated on finance-themed senders, switching on and off weekly, is a high-confidence campaign indicator."
A Warning Shot for AI-Era Security
For Microsoft's researchers, the episode illustrates a broader dynamic: techniques pioneered against AI systems do not stay confined to AI. "As AI-era attack methods become better understood, threat actors may adapt them for use in more traditional threats such as phishing and spam," they wrote, noting that the case shows how methods from AI security research "can quickly cross over into established attack ecosystems."
Ars Technica and other outlets that covered the research noted the irony: a trick developed to manipulate AI models is now best known for attacking the mundane filters that guard corporate inboxes. For security teams, the message is that AI-era threats and classic threats are converging — and that defending against the next campaign means scrubbing invisible characters everywhere text is processed, not just inside chatbots.
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
