ASCII smuggling crosses over from AI prompt injection to phishing evasion

Microsoft researchers discovered a phishing campaign leveraging ASCII smuggling, a technique involving insertion of invisible Unicode tag characters (U+E0000 to U+E007F) into financial keywords to evade detection. This method, initially studied in AI prompt injection contexts, was repurposed to bypass email filters by breaking up keywords such as 'funding' with invisible characters. The campaign generated millions of phishing emails daily over approximately three months starting February 9, 2026, using finance-themed disposable domains and a legitimate email marketing platform. The invisible characters prevent signature-based and machine learning-based detection systems from recognizing malicious keywords, enabling phishing attempts to reach users undetected.

The campaign effectively bypasses traditional keyword-based email filtering and machine learning detection by obfuscating financial keywords with invisible Unicode characters. This increases the likelihood of phishing emails reaching end users, potentially leading to successful phishing attacks targeting business loans and credit lines. The use of legitimate email marketing platforms and disposable domains further complicates detection and mitigation efforts. There is no indication of exploitation beyond phishing, and no known exploits in the wild beyond this campaign.

No official patch or fix is applicable as this is a phishing campaign technique rather than a software vulnerability. Defenders should update email filtering and detection systems to recognize and handle invisible Unicode characters used for obfuscation. Enhancing machine learning models to normalize or detect such character insertions can improve detection. User awareness training about phishing risks remains important. Monitoring and blocking the identified disposable domains associated with this campaign can reduce exposure. Since this is a campaign technique, no vendor patch exists; mitigation relies on detection improvements and user vigilance.