ASCII smuggling crosses over from AI prompt-injection research into mainstream phishing-filter evasion

Microsoft Defender for Office 365's hunting signature for the Unicode Tags block (U+E0000-U+E007F) (deployed to catch invisible characters used to smuggle instructions to AI models while hiding them from human readers) instead surfaced a large-scale phishing-filter-evasion campaign using the same code-point range for an unrelated purpose. Hits on the signature jumped from roughly 21,000 messages on 2026-02-08 to over 1.3 million the next day, sustained on a strict weekday-only cadence for roughly three months before dropping sharply after 2026-05-15 (Microsoft Threat Intelligence, 2026-09-03). Roughly 96% of flagged volume traced to around 150 disposable finance-themed sender domains built by recombining a small vocabulary of tokens. Rather than hiding a full instruction payload, the campaign spliced a single invisible TAG SPACE character into the middle of high-signal lure keywords such as "funding", defeating literal keyword and regex matching, and, more consequentially, disrupting the tokenization step of ML- and NLP-based spam classifiers: an unexpected code point mid-word can split a familiar token into unfamiliar sub-tokens the classifier has never seen. Mail was relayed through the legitimate email-marketing platform ActiveCampaign, whose link-rewriting laundered sender reputation so the URLs a recipient clicked pointed at ActiveCampaign's own tracking domains rather than the brand-impersonation domain shown in the message.

Microsoft states over 99% of flagged messages were still caught by layers that did not depend on the Unicode signal at all (sender, IP, URL and domain reputation, ML spam/phishing classification, brand-impersonation detection and authentication checks) but flags that Tag-block abuse is rarer than the more commonly-defended zero-width-space and non-breaking-space obfuscation classes, making it a plausible blind spot for any mail-filtering pipeline that does not normalize invisible Unicode before running content signatures. Microsoft's own filter stack separately runs OCR-based visual-text extraction as an available capability, which it notes could also catch this technique, but that layer is not part of the enumerated set behind the 99% figure.