Microsoft has identified a large-scale phishing campaign that repurposed a technique known as ASCII smuggling, typically associated with AI security risks, to evade email content filters. The campaign, which peaked at over 2.37 million messages in late February, utilized invisible Unicode tag characters to obfuscate financial keywords within phishing emails.
ASCII smuggling involves embedding invisible or non-rendering Unicode characters within text, making content appear normal to human readers while being decipherable by machines. This technique is commonly used in indirect prompt injection attacks, where malicious instructions are hidden within documents or webpages for AI models to process, potentially leading to data leaks or unauthorized actions.
However, in this observed phishing campaign, Microsoft's security team found no AI-specific instructions. Instead, the attackers inserted Unicode tag spaces, such as U+E0020, between letters of common financial terms. For instance, "funding" would appear as "fun⟨U+E0020⟩ding." This method aimed to bypass keyword matching and other signature-based email filters that would otherwise detect the malicious content.
Microsoft first detected the ASCII-smuggling signature in early February, flagging approximately 21,000 messages on February 8. The volume then surged dramatically to over 1.3 million messages the following day. Most of these emails originated from around 150 sender domains with finance-related themes.
The campaign maintained high activity for three months, with weekday volumes ranging from 1 to 2.37 million messages, peaking on February 26. A notable characteristic was the strict weekday-on, weekend-off schedule, with sending volumes dropping significantly on weekends. After an intense initial phase, daily message counts gradually declined by roughly 80 percent by late March. Activity dropped sharply after May 15 but continued with smaller, intermittent spikes through at least mid-June.
Microsoft researchers Noam Kochavi and Sarah Wolstencroft noted that this case demonstrates how techniques emerging in AI security research can quickly be adapted for traditional cyber threats like phishing and spam. They emphasized the need for defenders to adopt a cross-domain perspective when evaluating emerging threats.
To protect against such attacks, Microsoft recommends that organizations ensure their normalization and tokenization pipelines consistently handle Unicode tag characters. Specifically, any content evaluated by keyword, signature, or regular expression logic should first have invisible and non-rendering Unicode code points stripped or folded. This prevents attackers from splicing characters into words to defeat matching mechanisms. This control can also help mitigate ASCII-smuggling threats against AI assistants that process email content.
Additionally, Microsoft advises scanning for behavioral indicators. The observed campaign exhibited a distinctive pattern: high-volume sending from rapidly changing, finance-themed disposable domains, strictly adhering to a weekday-on, weekend-off schedule. A sudden spike in tag-block characters concentrated on finance-themed senders, switching on and off weekly, is considered a high-confidence indicator of such a campaign.
