Cybercriminals are using invisible Unicode characters to bypass email security filters and deliver phishing messages to users’ inboxes, Microsoft security researchers have warned.
The technique, known as “ASCII smuggling,” allows attackers to insert characters that are not visible to the recipient but can still be interpreted by computers and artificial intelligence systems.
Microsoft said the technique, previously associated with prompt injection attacks, has now been adopted by cybercriminals to evade phishing detection systems.
Invisible characters help bypass filters
Email security systems commonly scan messages for suspicious words and phrases associated with scams, including terms related to financing, loans and credit.
Attackers can insert invisible characters inside these keywords, effectively breaking them apart for security filters while leaving the words appearing normal to the recipient.
For example, a filter may interpret a word such as “funding” as separate strings because of the hidden characters inserted between its letters, while the recipient continues to see the normal word.
This can allow malicious emails to evade keyword-based security checks and reach users’ inboxes.
AI assistants could also be targeted
Microsoft researchers warned that the technique could pose an additional risk when users ask AI assistants to process or summarize suspicious emails.
According to Microsoft, invisible instructions embedded within an email could be interpreted by an AI agent as a prompt rather than ordinary text.
Depending on the attack, such instructions could potentially attempt to make an AI system extract sensitive information or perform other unwanted actions, including deploying malware.
Campaign peaked at 2.3 million emails a day
Microsoft said the phishing campaign has been active for several months.
The campaign reportedly peaked in February 2026, when more than 2.3 million emails per day were observed using the technique. Although activity has declined since then, Microsoft said the campaign remains active.
Researchers also identified a cluster of nearly 150 sender domains linked to finance-related themes in early February.
Those domains accounted for approximately 96% of the spam emails that Microsoft Defender for Office 365 detected as involving ASCII smuggling.
Microsoft recommends Unicode normalization
Microsoft said defending against the technique can involve normalizing Unicode tag characters and other invisible code points before applying keyword-based detection.
Security teams should also treat unexpected tag-block characters as potentially suspicious, researchers recommended.
