ASCII Smuggling Technique Evolves from AI Prompt Injection to Phishing Evasion
Attackers are repurposing AI-era ASCII smuggling techniques to bypass traditional email filters in high-volume phishing campaigns, Microsoft reports.
Microsoft researchers have identified a significant shift in threat actor tactics, observing a high-volume phishing campaign that leverages ASCII smuggling, a technique previously popularized in AI prompt injection research. This method uses invisible Unicode tag characters (U+E0000-U+E007F) to split financial lure words, effectively evading traditional email filters that would otherwise flag such terms.
The discovery emerged from Microsoft Defender for Office 365's prompt injection protection research, highlighting how advanced evasion techniques developed for AI interactions are now being applied to conventional cybersecurity threats. Telemetry data from Microsoft Defender for Office 365 indicated a sharp increase in detections related to ASCII smuggling beginning February 9, 2026, with elevated activity persisting on weekdays for approximately three months. Notably, the majority of these malicious messages were flagged by layered security protections rather than relying on a single, specific Unicode signal.
ASCII smuggling, in essence, involves the use of invisible or non-rendering Unicode characters to conceal content within seemingly normal text. The Unicode Tags block (U+E0000 to U+E007F) is particularly abused for this purpose. This block contains a hidden set of characters that mirror printable ASCII characters, originally intended for language tagging but now largely deprecated. The critical property for attackers is that these code points are typically not rendered by standard fonts and user interfaces, meaning a message can contain hidden instructions or obfuscated text that is invisible to a human reader but detectable by software processing the raw text.
This technique gained prominence in the AI security community throughout 2025, frequently appearing in prompt injection and cross-prompt injection (XPIA) research. Attackers would embed hidden instructions within web pages, documents, or emails, which AI models would process while human users remained unaware. This demonstrated a clear gap between human perception and AI interpretation, making it a popular tool for AI red-teaming and security research.
However, the very property that makes ASCII smuggling effective for AI prompt injection—its invisibility at the text-processing level—also makes it a potent tool for evading traditional security filters. By inverting the intent, attackers use the same mechanism to obfuscate keywords crucial for detecting phishing attempts. The technique allows them to split words like 'funding' into invisible character sequences, preventing signature-based filters from recognizing the malicious intent, while the email still appears legitimate to the recipient.
Microsoft's security team developed a hunting signature for ASCII smuggling as part of their AI security efforts, initially designed to detect hidden prompt injection content in emails. This signature, which looks for characters from the Unicode tags block, proved effective. After refining the signature to exclude legitimate uses, such as the subdivision flag emojis for England, Scotland, and Wales (which are encoded using tag characters), the remaining detections provided a reliable baseline. Spikes above this baseline then indicated malicious abuse of the technique.
The surge in activity observed on February 9, 2026, marked a transition from theoretical AI security research to practical, large-scale phishing operations. The financial lure words being split suggest that these phishing campaigns are aimed at tricking recipients into revealing sensitive financial information or credentials. The reliance on layered protections indicates that while the ASCII smuggling technique is novel, existing security frameworks are capable of detecting it when properly configured.
Microsoft advises organizations to ensure their email security solutions are up-to-date and employ layered defenses that can detect obfuscation techniques. User education on recognizing phishing attempts, even those that appear to bypass filters, remains a critical component of defense. The evolution of ASCII smuggling underscores the dynamic nature of cyber threats and the need for continuous adaptation in security strategies.