Microsoft finds phishers reusing the ASCII smuggling prompt injection trick at scale

What Microsoft found

Microsoft researchers described on 3 September 2026 a high-volume phishing campaign that used invisible Unicode tag characters. The technique is called ASCII smuggling. It became well known in prompt injection research, where attackers hide instructions inside text that a person cannot see but an AI assistant reads and may follow. The Unicode Tags block, U+E0000 to U+E007F, mirrors printable ASCII and is not rendered by most fonts.

The finding came out of work on prompt injection protection in Microsoft Defender for Office 365. A hunting signature built to catch hidden instructions aimed at AI systems in email jumped sharply on 9 February 2026. It fired on about 21,000 messages on 8 February and more than 1.3 million the next day, peaking above 2.3 million messages on 11 February. Most of the mail clustered into roughly 150 finance-themed sender domains promoting business loans and lines of credit.

Filter evasion, not instruction smuggling

When Microsoft sampled the messages, it found no hidden instructions for an AI assistant. The sender instead inserted a single invisible tag character inside lure words, so that funding travelled as fun, an invisible tag space, then ding. A person still reads funding. A literal keyword match or regex that does not normalise the text no longer finds the word, and a machine learning classifier may tokenise the broken word into rare pieces.

The campaign ran on weekdays and went almost silent at weekends. Volume stepped down by about 80% per weekday by late March, and high-volume use of the technique dropped sharply after 15 May 2026, with low residual activity into mid-June. Microsoft linked the activity to a broader SBA-themed phishing campaign delivered through the ActiveCampaign marketing platform that Fortra had documented earlier, before tag characters were added.

Who is affected and what Microsoft recommends

The risk sits with any mail filter or content scanner that matches keywords before normalising Unicode. Microsoft says Defender can render a message, extract visible text through OCR and analyse that, and that over 99% of the campaign's messages were flagged by signals such as sender, IP, URL and domain reputation, authentication checks and machine learning classification. Other products may behave differently, and Microsoft tells defenders to test their own pipelines.

Its advice is to normalise before matching: strip or fold tag characters and other zero-width code points before applying signatures, and treat tag-block characters as a strong anomaly signal, since outside the England, Scotland and Wales flag emojis they are rare in ordinary mail. Microsoft adds that the same normalisation should run before email reaches an AI assistant, which also reduces exposure to cross-prompt injection. Related coverage sits under Cybersecurity.

What to watch next

The case shows a technique moving from AI security research into ordinary spam within about a year. The open questions are whether other campaigns adopt tag characters, and whether mail and AI vendors publish how their pipelines handle them. The blog does not name the operator behind the domains or give loss figures.

Questions people ask

What is ASCII smuggling?

The use of invisible Unicode tag characters (U+E0000 to U+E007F) to hide text inside content that looks normal. It is best known as a way to hide prompt injection instructions from humans while an AI model still reads them.

Did the campaign attack AI assistants?

No. Microsoft says the sampled messages carried no hidden instructions for AI. The invisible characters were placed inside words such as funding to defeat keyword and classifier matching.

How can defenders block it?

Microsoft recommends stripping or normalising tag characters and other zero-width code points before running content signatures, and treating tag-block characters in mail as a strong anomaly signal.

Sources

1. ASCII smuggling crosses over from AI prompt injection to phishing evasion (Microsoft Security Blog (Microsoft Security Research), 3 Sep 2026)