{"slug": "microsoft-finds-an-ai-jailbreak-trick-fueling-a-2-37-million-email-phishing-wave", "title": "Microsoft finds an AI jailbreak trick fueling a 2.37 million email phishing wave", "summary": "Microsoft detected a phishing campaign that used an AI-developed technique called ASCII smuggling to evade email filters, peaking at 2.37 million messages on February 26, 2026. The campaign, described in a Microsoft Security Blog post by Noam Kochavi and Sarah Wolstencroft, inserted invisible Unicode characters into financial lure words like 'funding' to bypass keyword detection, with volume rising from 21,000 to over 1.3 million on February 9. The emails were sent via ActiveCampaign infrastructure, with 98.5% matching its envelope pattern and 92% originating from the 173.236.20.0/24 network block, highlighting how AI red-team techniques are now used in ordinary phishing.", "body_md": "*Microsoft found an AI jailbreak trick inside a finance-themed phishing campaign that peaked at 2.37 million emails in one day. The trick is tiny, but the warning is not: techniques built for AI red teams don't stay neatly inside AI security.*\n\nMicrosoft says ASCII smuggling has crossed into ordinary phishing. In a Microsoft Security Blog post published September 3, 2026, Microsoft Security Research, Noam Kochavi and Sarah Wolstencroft said a hunting signature built for hidden prompt-injection content instead surfaced a finance-themed email campaign using invisible Unicode characters to split high-signal words before filters could read them cleanly. The spike began on February 9, when signature hits jumped from roughly 21,000 the day before to more than 1.3 million. Weekday volume later peaked at 2.37 million messages on February 26.\n\nIt worked at scale.\n\n## How ASCII smuggling moved from AI tests to email\n\nASCII smuggling uses the Unicode Tags block, U+E0000 to U+E007F. These are valid characters, but most of them don't show up on screen. A person sees normal text. A machine still has to process the hidden code points sitting inside it. In AI security research, that gap was useful for hiding instructions in documents, web pages or emails that a model might ingest. In this campaign, the attacker used the same gap for a plainer job: breaking up financial lure words.\n\nMicrosoft's clearest example is the word funding. The email still displayed it normally to the reader, but the underlying string inserted an invisible tag character between fun and ding. A literal keyword filter looking for funding could miss what the recipient saw without effort. That's the useful warning. You don't need a new kind of fraud when a new kind of text handling lets an old fraud pass through familiar checks.\n\n[Microsoft posted record fiscal 2026 revenue as Azure crossed $100 billion and proved its AI bet is paying off](https://startupfortune.com/microsoft-posted-record-fiscal-2026-revenue-as-azure-crossed-100-billion-and-proved-its-ai-bet-is-paying-off/)\n\nMicrosoft closed fiscal 2026 with record revenue of $331 billion, Azure crossing $100 billion annually, and Copilot surpassing 30 million paid seats. The results stand in sharp contrast to Meta's crumbling margins, and offer the clearest evidence yet that enterprise AI spending is converting into real cloud revenue. - [Microsoft Azure revenue $100 billion](https://startupfortune.com/microsoft-posted-record-fiscal-2026-revenue-as-azure-crossed-100-billion-and-proved-its-ai-bet-is-paying-off/) - [AI spending ROI for enterprises](https://startupfortune.com/microsoft-posted-record-fiscal-2026-revenue-as-azure-crossed-100-billion-and-proved-its-ai-bet-is-paying-off/)\n\nThe campaign was not a weekend hobby. Microsoft said the activity ran in a strict weekday rhythm, went almost silent on weekends, and stayed elevated for roughly three months before dropping sharply after May 15, 2026. Weekdays only, like clockwork. That looks like scheduled bulk-send infrastructure, not someone manually pushing messages out of a mailbox.\n\n## The sender looked more normal than the message\n\nThe bulk of the mail moved through infrastructure associated with ActiveCampaign, the legitimate marketing automation platform. Microsoft said the platform's click-tracking domains, activehosted.com and acemlnd.com, appeared in the campaign links, and about 98.5% of observed messages matched the ActiveCampaign-style envelope pattern. Borrowed respectability, basically. About 92% of volume across two measured weeks came from the 173.236.20.0/24 network block, which Microsoft said is legitimate shared sending infrastructure - so the block itself tells you nothing about intent.\n\nThat detail matters. A phishing email sent through a throwaway server already looks dirty. A phishing email relayed through a known marketing platform can look like another business promotion, at least long enough to make reputation-based filtering harder. ActiveCampaign told Microsoft that messages containing invisible Unicode characters receive the same moderation verdicts as their unobfuscated versions, and that heavy use of the technique is treated as a suspicious signal. Even so, the campaign shows why shared sending platforms remain attractive to attackers. They borrow normality.\n\nMicrosoft also connected the activity to an earlier operation documented by Fortra's Intelligence and Research Experts team on September 18, 2025. Fortra said that campaign abused ActiveCampaign to send AI-generated phishing emails and landing pages aimed at businesses applying for Small Business Administration-style loan offers, with lures promising $4 million to $10 million in funding within 48 hours. The pages were built to collect business revenue, loan amount, credit score, role, tenure and contact details. That is not random spam. It is reconnaissance dressed as financing.\n\nThe target matters. Small business owners looking for funding are often already answering unfamiliar emails, filling out forms and comparing offers under pressure. If you're waiting for capital, a message about a line of credit doesn't have to be brilliant to get your attention. It only has to arrive at the right moment and look close enough to real.\n\n## The fix is dull, which is why it matters\n\nThe uncomfortable part is the direction of travel. ASCII smuggling became famous because AI security researchers used it to show how a model could read hidden instructions a human couldn't see. Now the same family of tricks is being used to dodge mail parsing in a campaign that Microsoft measured in millions of messages per weekday. Frankly, that is how security research often ages in public. A technique starts as a warning, then turns into a playbook for someone else.\n\nMicrosoft's own Defender for Office 365 stack still flagged more than 99% of the messages through layers that didn't depend on catching the tag characters directly, including sender, IP, URL and domain reputation, machine-learning classification, brand-impersonation detection and authentication checks. That is the part defenders should copy. Don't trust one signal. Don't assume visible text is the only text. Normalize before matching, strip or fold invisible characters, and test whether your filters treat funding and fun plus U+E0020 plus ding as the same word.\n\n[Microsoft, Uber, and Commonwealth Bank confirm AI is cutting customer service jobs not just in theory](https://startupfortune.com/microsoft-uber-and-commonwealth-bank-confirm-ai-is-cutting-customer-service-jobs-not-just-in-theory/)\n\nMicrosoft, Uber, and Commonwealth Bank of Australia have each publicly attributed 2026 customer service workforce cuts to AI deployment, marking the clearest corporate confirmation yet that automation is displacing jobs at scale. Microsoft reported $500 million in AI-driven call center savings, Uber cut 10% of its Community Operations team, and... - [AI replacing customer service jobs](https://startupfortune.com/microsoft-uber-and-commonwealth-bank-confirm-ai-is-cutting-customer-service-jobs-not-just-in-theory/) - [why companies cutting customer service roles](https://startupfortune.com/microsoft-uber-and-commonwealth-bank-confirm-ai-is-cutting-customer-service-jobs-not-just-in-theory/)\n\nMicrosoft has not named a criminal group behind the campaign. It doesn't need to for this story to be useful. The remaining fact is enough: a technique built to expose AI blind spots has already been repurposed against email systems, and the campaign kept running after the Unicode-heavy phase faded. The next version may not use the same characters at all.\n\n**Also read:** [South Korea Plans to Move $5.36 Trillion in Securities Onto a Blockchain](https://startupfortune.com/south-korea-plans-to-move-536-trillion-in-securities-onto-a-blockchain/) • [Four AI Labs Released Major Models in One Week and Buyers Can't Keep Up](https://startupfortune.com/four-ai-labs-released-major-models-in-one-week-and-buyers-cant-keep-up/) • [MikroTik Routers Are Being Hijacked Through A Flaw Patched Days Ago](https://startupfortune.com/mikrotik-routers-are-being-hijacked-through-a-flaw-patched-days-ago/)\n\n## Join the discussion\n\n[Open in the community →](/community/)\n\nAlmost there. Sign in and your reply posts straight away.", "url": "https://wpnews.pro/news/microsoft-finds-an-ai-jailbreak-trick-fueling-a-2-37-million-email-phishing-wave", "canonical_source": "https://startupfortune.com/microsoft-finds-an-ai-jailbreak-trick-fueling-a-237-million-email-phishing-wave/", "published_at": "2026-09-06 20:18:17+00:00", "updated_at": "2026-09-07 01:58:30.656215+00:00", "lang": "en", "topics": ["ai-safety", "ai-policy"], "entities": ["Microsoft", "Noam Kochavi", "Sarah Wolstencroft", "ActiveCampaign"], "alternates": {"html": "https://wpnews.pro/news/microsoft-finds-an-ai-jailbreak-trick-fueling-a-2-37-million-email-phishing-wave", "markdown": "https://wpnews.pro/news/microsoft-finds-an-ai-jailbreak-trick-fueling-a-2-37-million-email-phishing-wave.md", "text": "https://wpnews.pro/news/microsoft-finds-an-ai-jailbreak-trick-fueling-a-2-37-million-email-phishing-wave.txt", "jsonld": "https://wpnews.pro/news/microsoft-finds-an-ai-jailbreak-trick-fueling-a-2-37-million-email-phishing-wave.jsonld"}}