Microsoft: AI Evasion Technique 'ASCII Smuggling' Used in Massive Phishing Campaign

Microsoft researchers have uncovered a large-scale phishing campaign that repurposed "ASCII smuggling," a technique previously used for AI prompt injection, to bypass traditional email security filters. The discovery highlights a growing trend where evasion methods designed for large language models are adapted for classic cyberattacks.

The campaign utilized invisible Unicode tag characters—specifically those from the Unicode Tags block (U+E0000 to U+E007F), such as U+E0020—to split financial keywords. By inserting these non-rendering characters into words like "funding," attackers broke the keyword matching and regex signatures used by security software to flag phishing lures. The operation was significant, peaking at 2.37 million messages on February 26, 2026. According to the researchers, the activity followed a disciplined "weekday-on / weekend-off" schedule that persisted from February through mid-June.

The Shift from AI to Phishing

ASCII smuggling was originally developed to hide instructions from human readers while keeping them visible to AI models. In the context of indirect prompt injection, this allowed attackers to leak data or trigger unauthorized actions by embedding hidden commands within a webpage or document that an AI would process. In this latest campaign, however, the objective shifted from manipulating an AI to hiding malicious lures from security software.

Ironically, standard phishing filters failed to catch the campaign. It was instead detected by a hunting signature in Microsoft Defender for Office 365. This specific signature had been designed to protect against AI prompt injections, proving that the tool built for AI security was the only mechanism capable of spotting the smuggled characters in a traditional email context.

Why It Matters

This crossover demonstrates a critical vulnerability in how security pipelines handle Unicode normalization. If invisible characters are not stripped or "folded" before a message is analyzed, simple keyword and regex filters are easily defeated. It signals a "cross-domain" threat evolution where the boundary between AI security and traditional cybersecurity is blurring.

Microsoft researchers Noam Kochavi and Sarah Wolstencroft noted that this case illustrates how techniques emerging in AI security research can quickly migrate into established attack ecosystems. They argued that this reinforces the need for defenders to view emerging threats through a cross-domain lens rather than treating AI risks as isolated incidents.

What's Next

Security vendors must now update normalization processes to ensure non-rendering Unicode characters are neutralized before content analysis. As AI-driven evasion techniques mature, defenders must anticipate that any method used to trick a model may soon be used to trick a firewall or an email gateway. The industry will likely see a push for more robust Unicode handling to prevent similar "invisible" attacks from scaling.