Microsoft went hunting for prompt injections in email and found a mass phishing run instead, splitting words apart with characters nobody can see.
The trick was supposed to be an AI problem. ASCII smuggling – dropping invisible Unicode characters into text so that a machine reads one thing and a person reads another – has spent the past couple of years as a party piece in prompt-injection research. Microsoft has now caught spammers using it for something far more mundane, and far more scalable: hiding words from email filters.
The write-up from Microsoft Security Research, published on September 3, describes a campaign that took a plain phishing lure and broke it in half. Where the message should have read “funding”, it read fun, then an invisible tag character, then ding. A human still sees the word. A filter tokenizing the raw string may not.
A dead corner of Unicode #
The characters come from the Unicode Tags block, U+E0000 to U+E007F, which holds a shadow copy of printable ASCII: U+E0041 stands in for “A”, U+E0061 for “a”. The block was added for language tagging, a job it never really did, and it has been effectively deprecated for years. It renders as nothing at all. That is precisely why prompt-injection researchers latched onto it, and precisely why it works here.
What makes the find enjoyable is how Microsoft tripped over it. The detection came out of Defender for Office 365’s prompt-injection work, and the first, naive version of the signature kept firing on perfectly innocent mail – specifically on the England, Scotland and Wales flag emoji. Those three are assembled from a base flag code point followed by an invisible tag sequence spelling out the region: U+1F3F4 plus gbwls for Wales. Every Welsh flag in every email signature looked like an attack.
Then the volume showed up #
With the false positives tuned out, the numbers got loud fast. Microsoft’s telemetry sat at a low-thousands baseline through February 8, when the signature fired on roughly 21,000 messages. The next day it fired on more than 1.3 million. Weekday volumes then ran between one and 2.37 million messages, peaking on February 26, and stayed elevated on weekdays for about three months before tapering off by roughly 80% in late March.
Microsoft ties the activity to a wider phishing operation delivered through ActiveCampaign and themed around US Small Business Administration loans, one that Fortra had already documented separately and that The Hacker News puts at millions of machine-written messages. So this is not an elite crew inventing a weapon. It is a commodity spam outfit that picked a technique out of AI security research and pointed it at keyword matching.
Does it actually work? #
Mostly not, at least not at Microsoft, and that caveat matters. Whether the trick lands depends entirely on whether a mail pipeline normalizes or flags those characters before content detection runs. Defender takes a picture of the message and runs OCR over the visible text, which sidesteps the problem, and in the end more than 99% of these messages were caught by layers that never looked at the tag characters at all: sender and IP reputation, URL and domain reputation, ML spam classification, brand-impersonation checks, authentication. What the report cannot tell you is how every other vendor’s stack behaved, and it says so.
The guidance is unglamorous. Strip or normalize invisible Unicode before your content signatures see the text, and treat unexplained tag characters as a signal in their own right. Zero-width spaces and non-breaking spaces have been on everyone’s normalization list for years; this deprecated block frequently is not. The wider lesson is the one worth keeping: something built to fool a language model turned out to work just as well against a spam filter. Evasion tooling does not stay in the lane it was invented in.