ASCII smuggling: invisible Unicode beat email filters

A trick invented to jailbreak AI models turned out to work just as well on spam filters. Microsoft documented a phishing campaign that used ASCII smuggling — invisible Unicode tag characters wedged inside ordinary words — to slip financial-lure emails past keyword detection at volumes reaching 2.37 million messages a day. The lures were business loans, lines of credit, and advance funding. That is your inbox.

What actually happened

Per the Microsoft Security Blog, the campaign abused the Unicode Tags block, U+E0000–U+E007F. These are deprecated language-tagging code points. They render as nothing. A human sees funding; a naive string matcher sees fun + an invisible U+E0020 + ding, and a signature looking for the word funding misses.

The operational shape is worth noting because it reads like a business, not a hobby:

• Onset February 9, 2026, peaking above 2.3 million messages a day within two days, with the highest weekday volume on February 26
• Roughly three months of high-volume use, dropping off sharply after May 15, 2026
• About 150 disposable sender domains recycling the same vocabulary — capital, funding, loan
• Relayed through the ActiveCampaign marketing platform, with envelope senders shaped em-<digits>.<brand> and tracking links on acemlnd[.]com and activehosted[.]com
• A strict weekday cadence, near-silent on weekends

Microsoft's own number is the honest part: over 99% of the flagged messages were caught by layered defenses — sender reputation, ML classification, authentication checks — not by anyone detecting the tag characters. ActiveCampaign told Microsoft that messages containing invisible Unicode receive the same moderation verdicts as their unobfuscated equivalents. The Register covered it on September 4.

Why invisible Unicode matters for your business

Two reasons, and the second is the one people miss.

First, the lure was targeted at exactly the kind of business that reads a funding offer instead of deleting it. Finance-themed phishing works on owners who are actually shopping for capital. If your team gets a credit-line email, the verification step is a phone call to a number you already had, not a click.

Second, and this is the part that outlives this campaign: the same invisible characters are being fed into your AI tools. If you run an assistant that summarizes inboxes, triages support tickets, or drafts replies, it ingests the raw text — tag characters and all. That is the original use of this technique. Instructions your staff cannot see, that your model reads perfectly. We covered the same failure mode when zero-font HTML hijacked AI email summaries in 10 out of 10 runs and when CSS turned the inbox into an attacker-controlled render surface.

Microsoft's guidance is one line and it belongs in your code, not just your mail gateway: normalize before you match. Strip Unicode tag characters — and any other non-rendering code points — from text before it hits a rule, a classifier, or a model prompt. If you built the ingestion pipeline, this is a ten-line fix. If a vendor built it, ask them what their normalization step does, and take a non-answer as a no.

Sources: Microsoft Security Blog, The Register.