Microsoft Detects Massive Phishing Campaign Using AI-Based ASCII Smuggling Technique

Microsoft has uncovered a large scale phishing campaign that repurposed ASCII smuggling, a technique originally used to hide malicious prompts for AI models, to evade email spam filters. The campaign saw a dramatic surge in early February, with detections by Microsoft Defender for Office jumping from 21,000 messages on February 8 to over 1.3 million the following day. Activity peaked at more than 2.37 million messages in late February and remained elevated on weekdays for three months before declining sharply in mid May. The activity continued with smaller spikes through mid June.

ASCII smuggling utilizes invisible Unicode tag characters that are readable by computers but invisible to humans. While previously used for indirect prompt injection attacks to trick AI assistants into leaking data, threat actors adapted the method for traditional phishing. By inserting Unicode tag spaces between letters in financial keywords, such as writing "funding" as "fun⟨U+E0020⟩ding," attackers attempted to bypass keyword matching and content filters. The campaign primarily originated from approximately 150 finance themed sender domains and followed a strict schedule of being active on weekdays and silent on weekends.

Microsoft researchers Noam Kochavi and Sarah Wolstencroft stated that this case demonstrates how AI security threats can quickly cross over into established attack ecosystems. To defend against these attacks, Microsoft recommends that normalization and tokenization pipelines strip or fold invisible Unicode code points before content is evaluated by regex or keyword logic. They also suggest scanning for behavioral indicators, such as bulk volume from disposable finance domains that switch on and off weekly.