ASCII smuggling crosses over from AI prompt injection to phishing evasion Microsoft researchers observed a high-volume phishing campaign using invisible Unicode tag characters, a technique popularized in AI prompt injection research as ASCII smuggling, to split financial lure words such as 'funding' and evade email filters. The campaign, detected via Microsoft Defender for Office 365 prompt injection protection, saw a sharp increase in hits on a hunting signature beginning February 9, 2026, and remained elevated on weekdays for approximately three months. The technique exploits the Unicode Tags block (U+E0000-U+E007F) to hide content from humans while remaining visible to AI models and text-processing systems. Microsoft researchers observed a high-volume phishing campaign using invisible Unicode tag characters , a technique popularized in AI prompt injection research as ASCII Smuggling . Instead of using these characters to hide instructions from people while exposing them to AI models, the attacker used them to split financial lure words such as ‘funding’ to prevent email filters from parsing them. The finding emerged from Microsoft Defender for Office 365 prompt injection protection research, showing how AI-era evasion techniques can surface in traditional phishing campaigns. In Microsoft telemetry, hits on a hunting signature designed to detect ASCII-smuggling increased sharply beginning February 9, 2026, and remained elevated on weekdays for approximately three months. Microsoft Defender for Office 365 telemetry showed that the majority of messages were flagged by layered protections rather than by reliance on a single Unicode-specific signal. What is ASCII smuggling? “ASCII smuggling” refers to the use of invisible or non-rendering Unicode characters to hide content inside text that looks normal. The most abused range is the Unicode Tags block, U+E0000 to U+E007F. This block contains a shadow copy of the printable ASCII characters for example, U+E0041 mirrors ‘A’, U+E0061 mirrors ‘a’ . The block was originally intended for language tagging and is now largely deprecated. The important property for an attacker is this: most of these code points are not rendered by typical fonts and user interfaces. A string can therefore carry a message that is not readable to a human but will be processed by any language model or other software that receives a copy of the email content. Why the AI-security world made it famous Over the past year, ASCII smuggling became a recurring technique in the prompt injection and cross-prompt injection XPIA literature. The attack pattern is straightforward: 1. An attacker hides instructions inside invisible tag characters embedded in a web page, document, email, or other content. 2. A human and many user interfaces sees nothing unusual. 3. An AI assistant that ingests the raw text does “see” the hidden characters, decodes them as text, and may be induced to follow threat actor-controlled instructions, potentially including data exposure or unauthorized actions depending on the assistant’s permissions and safeguards. Because this technique cleanly demonstrates the gap between what the human sees and what the model reads, it appeared frequently in AI red-teaming write-ups, conference talks, and tooling throughout 2025. That attention put a spotlight on the U+E0000-U+E007F range. Because tag characters are invisible to humans but exist at the text-processing level, the same property that makes them useful for smuggling instructions into a model also makes them useful for obfuscating keywords before a detector evaluates them . The intent is inverted, but the mechanism is similar and a user’s suspicions are not raised. Writing a practical ASCII-smuggling signature As part of work on Microsoft Defender for Office 365 prompt injection protection, we built hunting logic for email-borne XPIA and prompt obfuscation patterns: content that looks harmless to users but may carry hidden instructions for an AI system that ingests the raw message. The same hunt designed to identify prompt injection risk in email became the starting point for this phishing-evasion discovery. One practical way to hunt for ASCII smuggling is to look for messages carrying characters from the Unicode tags block U+E0000-U+E007F , the hallmark of attempts to hide instructions from, or for, an AI model. That broad signature is a useful starting point, but it needs enough Unicode context to avoid mistaking legitimate tag-character sequences for abuse. The first version simply flagged any code point in that range, which proved too blunt. It kept firing on a small subset of perfectly legitimate messages – which, on inspection, all contained one of three subdivision flag emojis : the flags of England, Scotland, and Wales – because those emojis are encoded using tag characters. After those exclusions, remaining hits were mostly benign artifacts from email-security gateways, mailbox providers, and security or AI researchers forwarding or testing messages that contained tag characters. This provided a good baseline where any spikes would indicate abuse of this technique by attackers. Figure 1. The three subdivision flag emojis – England, Scotland, and Wales – that tripped the naive signature. Each is encoded as a sequence of invisible Unicode tag characters U+E0000-U+E007F . Figure 2. The Wales flag emoji pasted into the ASCII Smuggler tool from Embrace The Red. What renders as a single flag is actually a base flag code point U+1F3F4 followed by an invisible tag-character sequence spelling gbwls U+E0067 U+E0062 U+E0077 U+E006C U+E0073 and a terminating tag U+E007F – the same U+E0000-U+E007F range the signature watches for. What we observed: ASCII smuggling repurposed for phishing New activity emerges in telemetry The tuned ASCII-smuggling signature began as an AI-security hunt for hidden prompt injection content in email. Instead, it surfaced finance-themed phishing messages using the same Unicode range for filter evasion. On February 9, 2026 , signature hits increased sharply. The following chart reflects Microsoft Defender for Office 365 telemetry for the hunting signature over the measured period: The day before onset February 8 the signature fired on roughly 21,000 messages; the next day it fired on more than 1.3 million . Most of the emails can be formed into a cluster of roughly 150 finance-themed sender domains. Observed over three months with a weekly rhythm Continuing to track the clustered sender domains forward in time, we measured messages matching the activity described every day. The high-volume phase persisted for roughly three months after February 9 and dropped sharply after May 15, 2026 . These dates bound the observed use of the specific technique in our telemetry, not the broader campaign, which started earlier without it and continued without it. Two characteristics stand out: - A strict weekly cadence. The campaign ran hard on weekdays and went almost completely silent every weekend. Sundays’ volume collapsed to a near-zero and then back to full volume the next day. This on/off pattern is typical of scheduled bulk-sending infrastructure. - A long, gradual decline. After an intense first phase, with weekday volumes of 1 to 2.37 million messages, peaking on February 26 , the numbers stepped down slowly to roughly 80% less per weekday by late March. The high-volume usage of the technique dropped sharply after May 15 , with lower residual activity through mid-June and occasional smaller spikes. After identifying the activity through this technique-specific signal, we connected it to a broader ActiveCampaign-delivered SBA-themed phishing campaign that Fortra had documented earlier. That earlier reporting indicates the campaign predated the adoption of Unicode tag characters; our analysis focuses on the period and messages in which this method was present, not the full lifetime of the broader campaign. Not instruction smuggling, but filter evasion Observed obfuscation pattern When we looked at a sampling of the flagged messages, the surprise was there were no smuggled instructions to an AI assistant. Instead, the invisible tag characters were inserted inside common financial keywords , splitting them apart so that a literal signature or keyword match would fail. For example, a finance lure term that appeared normal to the recipient could be transmitted with an invisible tag character in the middle: funding became: Here, ⟨U+E0020⟩ represents the invisible Unicode TAG SPACE inserted between letters. In the messages we examined, the campaign did not encode a hidden ASCII message in the tag block; it used a single invisible tag character as a separator sprinkled inside high-signal words. Strictly speaking, this is invisible-character insertion using a code point from the ASCII-smuggling tag block, rather than full message smuggling. Why it can affect detection To a recipient, and to parsing pipelines that drop or normalize these characters, the word still reads as funding. To a detector matching the literal string funding, or a regex that does not account for interleaved invisible code points, the byte sequence no longer contains the contiguous keyword. Whether real-world detectors behave that way depends on their normalization step, which is examined below. The bigger prize for the attacker, though, is not preventing the literal string matches; it is the ML- and NLP-based models that increasingly drive modern spam and phishing classification. Unless a filtering system takes a picture of a message and does OCR extraction over the visual image, it may miss this type of attack. A standard email classifier may not reason over whole words exactly as a human sees them; for efficiency, they can first split text into tokens or sub-word pieces. A clean lure term such as funding may be represented as a familiar token or a familiar sequence of sub-tokens. Insert an invisible U+E0020 into the middle, however, and the tokenizer may no longer see that same familiar unit. It might split the text into fun, an unexpected tag character, and ding; it might emit rare or unknown sub-tokens; or, if normalization runs first, it simply removes the U+E0020 character, leaving funding. Why it can help defenders There is also a defensive opportunity. Since this kind of manipulation appears so seldom in normal traffic, its presence becomes a high-confidence signal. A technique meant to make messages look more benign to ML models can instead give defenders a low-false-positive indicator to detect on. What is known and what is new Inserting invisible or look-alike characters to break keyword and signature matching is a long-standing evasion technique used in spam and phishing : defenders have for years seen zero-width spaces U+200B , zero-width non-joiners, the no-break space U+00A0 , soft hyphens, and homoglyph substitutions used to fracture words so naive string matchers fail. What is new is the specific characters and scale of the campaign: - The character choice. Instead of the usual zero-width space or NBSP, this campaign reached for the Unicode Tags block . That block went from forgotten to famous over the past year because of AI security research into ASCII smuggling and prompt injections. - The scale and discipline. At its peak in Microsoft telemetry, the campaign generated multi-million message daily volume. - A possible detection blind spot. Because the Unicode Tags block is less commonly abused than zero-width spaces or NBSP, defenders should verify that normalization and tokenization pipelines handle tag characters consistently. Financially themed sending domains The campaign ran on hundreds of disposable, finance-themed sender domains with lures that resembled business loan, line-of-credit, and advance-funding phishing patterns often associated with fraud or credential-harvesting funnels. This pattern accounted for roughly 96% of the volume flagged by the hunting signature . The signature also fired on other domains, but those were unrelated senders – chiefly email-security gateways and personal mailbox providers – not part of the campaign. A partial sample of sender domains counts from February 9, 2026 alone illustrates both the naming pattern and the per-domain volume: | Sender domain | Hits Feb 9, 2026 | | guardiangrowthfunding . com | 30,442 | | digitalcapitalboost . com | 27,021 | | thebusinessloanexpress . com | 25,048 | | yourlocfunding . com | 24,482 | | advancefundingboost . com | 24,053 | | guardiancapitalway . com | 23,921 | | harboradvancefunding . com | 23,595 | | unitedfundingwave . com | 23,269 | | directcapitalboost . com | 22,875 | | onlinedirectfinance . com | 21,195 | | catalystcapitalharbor . com | 21,130 | | rocketboostfunding . com | 20,908 | | digitalrushcapital . com | 20,796 | | guardianloccapital . com | 20,781 | | guardianlocchoice . com | 20,553 | | ourbusinessloans . com | 20,444 | | directcapitalpulse . com | 19,767 | | catalystboostfunding . com | 19,519 | | elevatecapitalrush . com | 19,395 | | fundingexpresscapital . com | 18,695 | Table 1. Top 20 by signature hits of the 148 finance-themed campaign sender domains seen on February 9, 2026, illustrating the naming convention and per-domain volume. Every domain is just a recombination of the same small vocabulary. The 20 domains above are built from only 28 word-tokens: advance · boost · business · capital · catalyst · choice · digital · direct · elevate · express · finance · funding · growth · guardian · harbor · loan · loans · loc · online · our · pulse · rocket · rush · the · united · wave · way · your Sent through a legitimate email-marketing platform The finance-themed domains in Table 1 are the brand header / P2 domains the recipient sees, but the actual mail was relayed through infrastructure associated with the legitimate email-marketing platform ActiveCampaign. The platform, which is used widely for marketing, rewrites every outbound link in the message body to route through its own click-tracking domains acemlnd . com and activehosted . com , so the URLs the recipient clicks do not point at the brand domain at all – they look like: hxxps://＜account-id＞.acemlnd . com/＜tracking-token＞ hxxps://＜brand-subdomain＞.activehosted . com/＜tracking-token＞ Most of the flagged messages carried links associated with the platform’s tracking domains rather than direct links that point directly to the sender-branded domains. The envelope P1 senders were platform subdomains of the form em-