Phishers Use AI Prompt Injection Tactics to Bypass Email Filters

Cybercriminals are repurposing techniques designed to trick artificial intelligence to bypass traditional email security. Microsoft Security researchers have identified a high-volume phishing campaign that utilizes invisible Unicode tag characters to slip past automated filters.

The campaign employs a method known as "ASCII Smuggling," where attackers insert non-rendering characters into sensitive keywords. For example, by splitting a word like "funding" with invisible tags, attackers prevent security filters from recognizing the financial lure while the text remains legible to the human recipient. According to Microsoft telemetry, the scale of this attack surged dramatically on February 9, 2026, with detections jumping from approximately 21,000 to over 1.3 million messages.

From AI Injection to Email Evasion

ASCII Smuggling did not originate in phishing; it is a crossover from AI prompt injection research. Originally, the technique was developed to hide specific instructions from human users while ensuring they remained visible to Large Language Models (LLMs). In this new campaign, threat actors have inverted that logic. Instead of hiding text from humans, they use these characters to hide keywords from automated parsing tools.

Microsoft discovered the shift during research into prompt injection protection for Microsoft Defender for Office 365. The Microsoft Security Research team noted that attackers used these characters to split lure words, ensuring email filters could not parse them.

The Security Gap

This evolution represents a significant shift in the phishing landscape, demonstrating how evasion tactics designed for the AI era are being weaponized against legacy infrastructure. Most traditional email filters rely on signature-based detection or heuristics to flag suspicious keywords. By breaking those keywords at the character level using Unicode tags, attackers render these defenses ineffective.

This trend highlights a growing gap between AI-driven evasion and traditional security parsing. As attackers adapt techniques from the LLM space, security vendors must move beyond simple keyword matching to identify more sophisticated patterns of character manipulation.

What to Watch

While the primary goal of this specific campaign is to deliver financial lures at scale, the broader implication is the portability of AI-attack vectors. Security teams should monitor for unusual Unicode patterns in incoming mail and update parsing logic to account for non-rendering tag characters. It remains to be seen if other AI-centric evasion methods will be similarly adapted for traditional social engineering attacks.