As artificial intelligence (AI) continues to evolve rapidly, AI-powered email security systems are becoming more effective at identifying and blocking unwanted, suspicious, and potentially harmful messages. However, cybercriminals and spammers are also constantly developing new techniques to get around these security measures.
One such technique is ASCII Smuggling, which spammers are increasingly using to keep spam and phishing emails from being detected by security filters.
Microsoft researchers said on Thursday, September 3, that they had identified a large-scale phishing campaign involving ASCII Smuggling. In the campaign, attackers inserted invisible Unicode tag characters into emails. These hidden characters can make it difficult for email filters to correctly parse and analyse the actual content of a message.
ASCII Smuggling is not a new technique. It has previously been used to hide malicious instructions in attacks targeting AI agents. Such attacks are commonly known as Prompt Injection Attacks.
According to Microsoft, the use of ASCII Smuggling in spam campaigns has increased significantly since the beginning of 2026. Researchers said that on one day in February 2026, Microsoft Defender for Office detected around 21,000 ASCII Smuggling signatures. The number then suddenly jumped to more than 1.3 million.
Over the next four days, the number of detections climbed further to around 2.5 million before falling sharply in mid-May.
Microsoft’s research shows that techniques originally developed to evade AI security systems are now being adapted to make traditional phishing attacks more effective. This is particularly concerning because email remains one of the primary channels used by cybercriminals for phishing, malware distribution, and other online scams.
The trend also highlights the constantly evolving challenge facing cybersecurity experts. Attackers are not only trying to hide the contents of their messages but are also exploiting the way automated security systems read and analyse text.
Microsoft explained that tag characters are invisible to humans but remain present at the text-processing level. This means the same property that allows them to be used for hiding instructions from or within AI models can also be used to conceal keywords before a security detector analyses them.
According to the company, although the purpose may be different, the underlying mechanism is largely the same. More importantly, the hidden characters are difficult for ordinary users to notice and therefore may not raise suspicion. Microsoft has also provided developers with recommendations for modifying email filtering systems to detect ASCII Smuggling.
What Is ASCII Smuggling?
ASCII Smuggling began receiving significant attention more than two years ago as a technique for making Prompt Injection Attacks against AI agents more difficult to detect.
Large Language Models (LLMs) used by AI agents process text differently from humans. They generally convert text into smaller units known as tokens. As a result, directly inserting malicious instructions into an email or other untrusted content may not always produce the desired outcome.
Attackers can instead encode text using a specific range of Unicode tag characters. For example, the Unicode tag point U+E0041 represents ‘A’, while U+E0061 represents ‘a’. A total of 128 tag characters can be used to represent the ASCII character set.
The key characteristic of these characters is that they are almost completely invisible to humans, while computers and certain software systems can still detect and process them.
By encoding malicious instructions using hidden Unicode characters, attackers can conceal the content from users while allowing systems capable of interpreting the encoded text to access and process it.
How Does ASCII Smuggling Bypass Spam Filters?
Traditional spam filters often search for common words, phrases, and patterns associated with unwanted or mass emails. These may include dollar amounts as well as keywords such as “credit” and “term”.
To avoid detection, attackers can insert invisible Unicode tag characters in the middle of ordinary words. For example, hidden characters could be inserted into the word “funding”, causing a filter to interpret it as separate parts, such as “fun” and “ding”.
However, the recipient would still see the complete word “funding” on their screen. In other words, the message appears normal to a human, while its underlying text may look different to an automated filter.
According to Microsoft, the attackers’ goal is not limited to bypassing traditional keyword matching. An even bigger target is the Machine Learning (ML) and Natural Language Processing (NLP) models that have become an important part of modern spam and phishing detection systems.
These AI-based systems do more than simply look for individual keywords. They also analyse the context, meaning, and overall content of an email. If hidden Unicode characters interfere with how the text is interpreted, the security model may fail to identify the message as malicious or suspicious.
Microsoft said one potential way to detect attacks involving ASCII Smuggling is to visually render the email and then use Optical Character Recognition (OCR) to extract the visible text. However, email security systems that do not use this additional processing could potentially miss some malicious messages containing ASCII Smuggling.
The growing use of ASCII Smuggling demonstrates how cybercriminals are adapting traditional phishing techniques to exploit weaknesses in AI-driven security systems. As machine learning and language models become increasingly important to spam filtering, cybersecurity teams will need to look beyond what an email says and also examine how its underlying text is encoded and interpreted by automated systems.
