Summary

• The campaign targeted finance and corporate accounts with business loan and credit lures, peaking at over 2.37 million emails per day.
• Attackers inserted the invisible Unicode Tag Space character (U+E0020) between the letters of high-signal words such as “funding”.
• Machine learning models and regex filters read the broken word and did not flag it. People saw clean text because the characters do not render.
• The trick came from AI red teaming, where it hides prompt injection payloads. It is now a phishing filter bypass.
• The fix is Unicode normalization: strip tag characters (U+E0000 to U+E007F) before any filter or AI classifier analyzes the text.

What is ASCII smuggling?

ASCII smuggling is the practice of embedding invisible Unicode tag characters alongside visible text, so machines read something different from what people see. Most applications do not display tag characters at all, which makes the hidden content invisible to the reader.

Security researchers first described it as a way to hide instructions inside text sent to AI models. If a model processes the hidden characters, it can follow instructions the user never saw. That is a form of prompt injection.

How does ASCII smuggling bypass email filters?

ASCII smuggling bypasses filters by breaking the words they look for, without changing what the reader sees. In the campaign Microsoft documented, it worked in three steps:

1. The ghost character: attackers placed the Unicode Tag Space (U+E0020) between the letters of a financial keyword, so “funding” became f[U+E0020]u[U+E0020]n[U+E0020]d[U+E0020]i[U+E0020]n[U+E0020]g in the raw text.
2. The evasion: machine learning models and regex rules that analyzed the raw string did not recognize the broken word, so the email passed.
3. The victim’s view: text rendering engines ignore tag characters, so the recipient saw the normal word “funding” in a clean, professional email.

Older tricks such as zero-width spaces or Cyrillic lookalike letters (homoglyphs) are now widely detected. Unicode tags are a less watched corner of the standard.

Mock example of an ASCII-smuggled phishing email, created for illustration. Not a real attack.

What are Unicode tag characters?

Unicode tags are a block of non-rendering characters, from U+E0000 to U+E007F, created to tag text with language information. Today they are mostly used inside some flag emoji sequences. When used on their own, most apps show nothing, which is exactly what makes them useful for hiding content.

Why does ASCII smuggling matter for security teams?

ASCII smuggling matters because it shows techniques moving from AI attacks to traditional phishing. A method built to manipulate LLMs now defeats perimeter email security. As more organizations use AI to classify email, read documents and run agents, any text pipeline that does not clean its input is exposed to both filter evasion and prompt injection.

How can organizations defend against ASCII smuggling?

The core defense is Unicode normalization before inspection. Practical steps:

• Normalize at the gateway: configure secure email gateways (SEGs) and AI pipelines to strip non-rendering tag characters (U+E0000 to U+E007F) before any spam, phishing or AI classification runs.
• Check the raw source: if a financial email feels wrong but shows no warnings, open “View original” or the raw message. Smuggled words appear as escape codes such as \u{E0020}.
• Do not trust clean formatting: an email that passed filters and looks perfect can still be malicious. Verify high-risk financial requests through a bookmark or a known phone number.
• Apply the same rule to AI tools: clean text before it reaches LLMs, copilots or agents, so hidden instructions cannot steer them.

How PhishFort helps

Filter evasion is one way phishing reaches inboxes. PhishFort Abuse Mailbox turns phishing that employees and customers report into investigation and takedown, so the sites and accounts behind a campaign come down even when a message slipped past the filters.

Jargon buster

• ASCII smuggling: embedding hidden Unicode tag characters alongside visible text to trick machine readers without changing what people see.
• Unicode tags block (U+E0000 to U+E007F): a set of non-rendering characters created for language tagging and now used in some flag emojis. Most apps display them as nothing.
• Unicode normalization: cleaning and stripping invisible control and tag characters from text before it reaches security filters, regex rules or AI classifiers.
• Prompt injection: hiding instructions in content an AI model processes, so the model does something its user did not ask for.

Frequently asked questions

Sources

• Microsoft Security Blog: ASCII smuggling crosses over from AI prompt injection to phishing evasion (September 3, 2026)