ASCII Smuggling Exploited in Phishing, 2.37 Million Messages Detected

Microsoft has detected a large-scale phishing campaign abusing invisible Unicode characters. Volume peaked at over 2.37 million messages in late February. It is a case in which ASCII smuggling, known for indirect prompt injection into AI assistants, was repurposed for conventional email fraud. According to reporting by Jessica Lyons of The Register, Microsoft researchers Noam Kochavi and Sarah Wolstencroft published details in a blog post dated September 4.

ASCII smuggling exploits the property of appearing as normal text to the human eye while being interpreted as a different string by machine processing. It is notable as an example of an AI-era attack technique flowing into existing criminal infrastructure.

Attack Technique Abusing Invisible Characters

ASCII smuggling is a technique that embeds non-rendered Unicode characters in text. It looks like normal strings to humans, but hidden content is read during parsing. In AI security research, it has been known as a means of indirect prompt injection. Attackers hide instructions with invisible characters in web pages and documents. An AI assistant reads them without the user noticing, potentially leading to information leaks or unauthorized operations. This incident is distinctive in that the same concealment technique was applied for a different purpose. In Microsoft’s detection, invisible code points called tag characters were used. They are inserted between characters and cause no visible change. Recipients read the body without noticing anything unusual.

Detection Evasion by Splitting Financial Terms

The attackers in this case did not embed instructions for AI. They inserted invisible characters inside financially themed lure terms to evade detection. The aim appears to have been to defeat string matching and keyword checks. For example, instead of writing the word “funding” as-is, they inserted a tag space in the middle. It appears as “funding” on display, but the internal representation is split. This prevents detection by exact string matching.

The researchers stated the following about the results of their sampling:

When we examined a sample of flagged messages, what was surprising was the absence of smuggled instructions to AI-powered features

They also explained the specific evasion structure:

The invisible tag characters were inserted inside common financial terms. The aim was to split the phrases to defeat literal signatures and keyword matching

To humans, it reads naturally as a discussion of money. Meanwhile, automated filtering mechanisms cannot recognize the terms. It can be described as a design exploiting the gap between the display layer and the processing layer.

Volume Trends Surging in Late February

Microsoft first detected ASCII smuggling signatures in early February. Detections numbered about 21,000 on February 8. The following day, they surged to over 1.3 million. Activity peaked in late February, reaching over 2.37 million messages. It then remained at high levels, centered on weekdays, for three months. It gradually declined toward mid-June. The sharp increase in a short period indicates the existence of an automated sending infrastructure. Higher volumes on weekdays may have targeted opens during business hours. Many of the messages reportedly targeted accounting and finance staff with tailored wording. The attackers used financial terminology, posing as funding offers, invoices, and money transfer procedures. They prompted opens and replies with content appealing to recipients’ work-related interests. The insertion of invisible characters was concentrated on key terms rather than the entire body.

New Responses Required from Defenders

The researchers warned that AI-era attack techniques will be adapted to conventional threats. They characterized it as a case of technology born in the AI domain rapidly spreading to established attack infrastructure. They argued defenders need a cross-domain perspective.

As understanding of AI-era attack techniques grows, threat actors may repurpose them for conventional threats such as phishing and spam

This shows how technology born from AI safety research is rapidly spreading to established attack infrastructure. Defenders need to view emerging threats from a cross-domain perspective

Countermeasures will center on Unicode normalization and visualization. It is effective to strip tag characters and zero-width characters at receipt and convert to a normalized form. Detection rules must be applied to the normalized string, not the displayed string. In addition to defense in the email path, hardening at the endpoint and OS layers is also important. For example, Strengthened AF_ALG Restrictions, New sysctl Introduced in Linux 7.3 is an effort to tighten cryptographic processing paths. The direction of stricter input handling aligns with the measures in this case. Management of AI development infrastructure is also a challenge. As shown by NVIDIA Announces $12.9 Billion Acquisition of Hugging Face, the distribution of training data and models is becoming increasingly concentrated. Contamination with data containing invisible characters could affect both training and inference. Inspection systems from development through operations are required.

Editorial Opinion

Looking at short-term impact: over the next three to six months, filter evasion using invisible characters is likely to spread to other spam and targeted attacks. Applications may expand beyond financial terms to messages posing as invoices or authentication notices. We expect email defense products to add or update Unicode normalization features. Deploying organizations will likely need to review detection rules and re-examine receipt logs. Taking a long-term view: within one to three years, design premised on differences between display and machine interpretation will likely become standard. Removal of invisible Unicode code points and warning displays may spread to document editing and viewing functions. As integration between AI assistants and email functions advances, inspection of concealed strings will become central to safety measures. Transparency in character handling will likely be demanded in both specification and implementation. Questions from the editorial team: Should defenders prioritize convenience or strict inspection? Uniform removal of invisible characters could cause false positives and affect international notation. Is information sharing on the defense side sufficient given the attackers’ speed of adaptation? We assess that structures integrating knowledge from the AI domain and email defense are being called into question.

References

• “ASCII smuggling isn’t just an AI security risk”, by Jessica Lyons — The Register, 2026-09-04T19:23:25.000Z (ARR)
• Source URL: https://www.theregister.com/security/2026/09/04/ascii-smuggling-isnt-just-an-ai-security-risk/5294595