Invisible Unicode Phishing: How to Spot and Block It

A Trick From AI Attacks Has Moved Into Your Inbox

Microsoft threat researchers have documented a large-scale phishing campaign that hides invisible Unicode characters inside ordinary words to slip past keyword-based email filters. The technique, usually called ASCII smuggling, was best known as a prompt-injection method against AI systems. It has now been industrialized by spam operators, and the good news is that the fix is both simple and something defenders can apply today.

• 2.37 million messages a day at peak in late February 2026, during a high-volume phase running from February 9 to mid-May
• 148 finance-themed sender domains accounted for roughly 96% of flagged messages, using words like funding, capital, loan, advance and credit
• Microsoft Defender for Office 365 blocked over 99% of the campaign using signals other than keywords — sender reputation, IP checks and domain verification
• The fix is normalization: strip or normalize Unicode tag characters before running keyword detection or feeding content to an AI system

The campaign is ongoing at reduced volume. That makes this a good moment to check whether your own filtering pipeline is doing the normalization step, because the technique is trivial to reuse and it is now demonstrably effective at scale.

How ASCII Smuggling Works

Unicode contains a block called Tags, running from U+E0000 to U+E007F. The characters in it render as nothing. They occupy no visual space, they produce no glyph, and a human reading the message sees a perfectly normal word.

A filter looking for the literal string "funding" sees something else entirely. Insert an invisible tag character in the middle and the word becomes two fragments with an unprintable code point between them. The string comparison fails. The message passes. The recipient reads "funding" because their mail client renders exactly what a person would expect.

That asymmetry — identical to a human, different to a matcher — is the whole attack. It is the same property that made the technique useful against AI systems, where invisible instructions could be embedded in text a reviewer would read as innocuous. The spammers did not invent anything; they noticed that a technique developed for one target works just as well against the pattern-matching layer of an email gateway.

Readers who follow supply-chain security will find this familiar. We covered the same underlying primitive when the GlassWorm campaign hid malware in invisible Unicode across more than 151 GitHub repositories. Different target, identical trick.

What Defenders Should Actually Do

The remediation is unglamorous and effective. Two steps cover most of the exposure.

• Normalize before you match. Strip or fold Unicode tag block characters — and other zero-width and invisible code points — out of message content before applying any keyword, regex or signature-based detection. A rule that runs on non-normalized input is a rule an attacker can walk around with a single character.
• Strip invisible code points before AI processing. If any part of your pipeline hands email content to a model — summarization, triage, classification, an agent that reads mail — remove invisible characters first. Otherwise the same trick that hides text from your filter can hide instructions from your reviewer.

Two more things are worth doing if you own the pipeline. Log when normalization changes a message, because a sudden rise in invisible-character stripping is itself a strong campaign indicator. And treat the presence of tag-block characters in ordinary prose as suspicious in its own right — legitimate business email essentially never contains them.

Why Layered Detection Won Here

The most instructive number in Microsoft's writeup is the 99% block rate achieved without any keyword matching at all. The campaign defeated the content layer completely and still failed, because sender reputation, IP checks and domain verification do not care what the words say.

That is the practical argument for defense in depth, stated as a measurement rather than a slogan. A single evasion technique can retire an entire detection method overnight — the keyword layer went from useful to blind the moment attackers added one invisible character. Layers that reason about infrastructure rather than content are far harder to bypass, because the attacker has to actually change their infrastructure rather than edit a string.

The 148-domain cluster is the other half of that lesson. Finance-themed sender domains registered in bulk and pushed through a legitimate email marketing platform are a recognizable pattern regardless of the payload. Concentration like that — 96% of traffic from one cluster — is exactly what reputation systems are built to catch.

The Broader Lesson for AI-Adjacent Security

There is a genuinely useful pattern here for anyone building AI into a security workflow. Techniques developed to attack models do not stay in the AI domain. ASCII smuggling was a prompt-injection curiosity; it is now a commodity spam evasion. The traffic goes the other way too, and the practical response is the same in both directions: sanitize input at the boundary, before it reaches either a matcher or a model.

If you run mail infrastructure, the action item today is a one-line check — confirm your gateway normalizes Unicode before keyword evaluation. If you run an AI pipeline that ingests untrusted text, the action item is the same check at a different boundary. More defensive guidance is in our AI security coverage, including our walkthrough of locking down a self-hosted LLM server.

Sources: BleepingComputer — September 6, 2026; Ars Technica — September 4, 2026; The Register — September 4, 2026.