ASCII smuggling crosses over from AI prompt injection to phishing evasion

Strategic summary

The report describes how the ASCII smuggling technique, originally known from AI prompt injection attacks, is now being used in phishing campaigns to evade email filters. Attackers use invisible Unicode tag characters to hide parts of words such as 'funding', so filters cannot detect them while recipients read the text normally. Microsoft observed a sharp increase in such attacks starting on February 9, 2026, which lasted for about three months. Most messages were detected by layered protection mechanisms, not by a single signature.

Key findings

• Attackers use invisible Unicode tag characters from the block U+E0000 to U+E007F to obfuscate keywords such as 'funding' and bypass email filters.
• The ASCII smuggling technique originates from AI prompt injection research and is now being used in phishing campaigns.
• Microsoft telemetry shows a sharp increase in such attacks starting on February 9, 2026, lasting about three months.
• Most messages were detected by layered protection mechanisms, not by a single Unicode-based signature.
• The invisible characters are not visible to humans but are processed by software such as email filters or AI models.