Microsoft's security researchers have documented a spam operation that abused invisible Unicode characters in a way that marks a curious crossover from AI adversarial research into everyday email abuse. For the past two years, these characters have been the foundation of a well-known class of AI prompt injection. The machine can read them; people cannot. What caught Microsoft's attention was that they had shown up in bulk spam, with the attackers doing something far less ambitious: splitting the word 'funding' in the middle with a character no human would ever see.

The technique is called ASCII smuggling. It works because the Unicode standard includes a block of code points that invisibly mirror the printable ASCII characters. A person reading an email sees a normal word like 'funding.' An email filter or an AI model consuming the raw text sees something else: 'fun', an invisible code point, then 'ding.' That small discrepancy is enough to defeat exact keyword matching and to disrupt the tokenization used by modern machine-learning classifiers.

The hidden character block nobody wanted

At the center of this story is the Unicode Tags block, which occupies the range U+E0000 to U+E007F. This block contains an invisible shadow copy of the printable ASCII characters. For example, U+E0041 mirrors a capital A, and U+E0061 mirrors a lowercase a. These code points were originally intended for language tagging, a mechanism that could mark text as belonging to a particular language without displaying any visible markup. Unicode later abandoned that idea. A subsequent attempt to repurpose the block for regional flags also failed, because the resulting characters worked poorly in practice. The characters remained in the specification, readable by software and invisible to people, waiting for someone to find a new use.

That new use came from AI security researchers. Tag characters can be embedded in a webpage, email, or document without being noticed by a human reader. An AI assistant that ingests raw text will read the invisible characters along with the visible ones, which means a carefully placed string of tag characters can carry hidden instructions. A person sees an innocent page. A language model sees a command. This is the prompt injection version of ASCII smuggling, and it has been demonstrated in a variety of contexts over the past two years.

Researchers have hidden instructions inside Word documents that then caused an AI assistant to alter spreadsheet figures and infect the next file it processed. Another demonstration hijacked a coding assistant by asking it to summarize a malicious web page. A separate team fed an AI agent a phishing email and extracted AWS keys from it. In all these cases, the fundamental trick is the same: the machine reads something the person cannot see, and it acts on that hidden content as if it were legitimate instruction.

From AI trickery to ordinary spam

Microsoft built a hunting signature to detect the use of Tag characters in email, in part because these characters were becoming known as an AI attack vector. When the signature produced a spike in alerts, researchers pulled a sample expecting to find hidden prompt-injection instructions. Instead, they found something considerably more mundane. The invisible characters were inside ordinary words, placed there to break up recognizable strings. One tag space had been inserted in the middle of a common financial lure term. So 'funding' traveled as 'fun,' then an invisible character, then 'ding.'

The recipient sees the word 'funding' and has no reason to suspect anything is wrong. A filter that matches the literal string 'funding' will not find it, because the underlying text no longer contains that exact sequence of characters. Keyword matching, however, was the smaller prize. Modern spam classifiers typically run on machine-learning models that split text into tokens before reasoning about it. Inserting one invisible character can turn a familiar token into two unfamiliar fragments, or into a rare sub-token that the model has barely seen. This makes the obfuscated word look less like phishing language and more like noise.

Microsoft noted that the mechanism is similar to prompt injection, but the intent is inverted. In an AI attack, the invisible characters are used to smuggle instructions in. In this spam campaign, they were used to smuggle meaning out. In both cases, the attacker relies on the fact that a human's suspicions are not raised because nothing looks wrong to the eye.

Why the campaign failed

Despite the scale of the operation, the evasion technique did not actually work. According to Microsoft, more than 99% of the messages were caught by layers that had nothing to do with the invisible characters. Sender reputation, IP reputation, URL checks, domain screening, authentication validation, brand impersonation detection, and the machine-learning classifiers all fired independently. Microsoft Defender also photographs message content and reads the text back with optical character recognition, which sees what a human sees rather than what the raw bytes contain. That provided an additional layer of protection that the tag characters could not defeat.

There was a second problem for the attackers. Tag characters are so extraordinarily rare in ordinary email that their presence is itself a beacon. Microsoft made the presence of these characters a high-confidence indicator of suspicious activity. In an instant, the evasion technique became a detection technique. Attackers who used it were making their messages stand out rather than blend in.

The first version of the detection signature had one false-positive problem, and it is a memorable one. It kept firing on legitimate email that contained the emoji flags of England, Scotland, and Wales. Those three flag emojis are built from invisible tag characters. A sequence of tag letters is combined to produce a single visible flag, and the email signature initially read those sequences as malicious. This quirky false positive highlights just how uncommon tag characters are in practice. When they appear, it is either because someone is deliberately abusing them or because a user sent a flag emoji.

The scale and rhythm of the campaign

The attack was not a small test. On 8 February, the Microsoft detection signature fired on roughly 21,000 messages. The very next day, it fired on more than 1.3 million. For about three months, weekday volumes ran between 1 million and 2.37 million messages. Traffic collapsed to near zero every Sunday and then returned on Monday, a pattern that is typical of scheduled bulk-sending infrastructure rather than of human operators manually sending mail.

Volumes fell roughly 80% per weekday by late March. There was another sharp drop after 15 May, and then a small residue of activity continued into mid-June. Microsoft's own blog post contains two different peak dates. A chart caption places the high point above 2.3 million on 11 February, while text elsewhere in the same post says the peak came on 26 February. Other reporting on the campaign has cited detections reaching 2.5 million within four days. The exact highest single day is therefore in dispute, but the shape and scale of the campaign are not. It was large, it was sustained, and it was largely automatic.

Domains assembled from a tiny vocabulary

The mail came from about 150 disposable, finance-themed sender domains. On 9 February alone, there were 148 of them. What made these domains noteworthy was that they were assembled from a vocabulary of only 28 words: advance, boost, business, capital, catalyst, choice, digital, direct, elevate, express, finance, funding, growth, guardian, harbor, loan, loans, loc, online, our, pulse, rocket, rush, the, united, wave, way, and your. Recombining those words produced names like guardiangrowthfunding, digitalcapitalboost, advancefundingboost, and 145 more. The busiest domain took more than 30,000 hits in a single day.

None of those domains actually sent the mail. The campaign relayed its messages through ActiveCampaign, a legitimate marketing platform. The platform rewrites every link to route through its own tracking domains, which meant that link reputation checks initially saw the trusted marketing infrastructure rather than the attacker's own servers. About 92% of the volume came from a single network block belonging to that platform.

Borrowing a trusted platform's reputation is now standard practice among spammers and scammers. Building infrastructure is expensive, and new domains and IP addresses are quickly blacklisted. Legitimate marketing platforms offer deliverability, established sender reputation, and built-in analytics. Attackers abuse those platforms because volume is cheap but trusted infrastructure is scarce.

ActiveCampaign told Microsoft that it had tested the technique against its own moderation systems. The company said obfuscated messages received the same verdicts as clean ones. It also said heavy use of invisible characters is treated as a suspicious signal in its own right. That extra layer likely contributed to the campaign's failure to evade detection within the platform itself.

A broader phishing operation

The invisible-character phase was just one chapter of a longer operation. Fortra, a cybersecurity firm, documented the broader campaign in September 2025. At that time, the same platform was being used to send AI-generated phishing messages aimed at Small Business Administration loan applicants. That earlier campaign used the legitimate marketing platform before the tag characters appeared, and it continued after they stopped. This timeline suggests that the invisible-character technique was layered onto an existing phishing operation rather than representing a completely new attacker.

The use of AI-generated phishing messages also fits the larger pattern of AI-enabled abuse. Google sued a Chinese operation in June that used Gemini to build phishing sites and send millions of scam texts. AI makes it cheap to generate believable lures at scale, while invisible Unicode characters make those lures harder to detect. The two techniques can be combined with ease: an AI writes the tempting headline, and a tag character hides a word from naive filters.

How to defend against ASCII smuggling

Microsoft's defensive advice is simple: strip or fold invisible code points out of subject and body text before any keyword, signature, or regex logic examines it. If tag characters are removed or converted to their visible ASCII equivalents early in the pipeline, the obfuscation disappears. A message that contains 'funding' after normalization will be matched by filters just as easily as a message that was never obfuscated in the first place.

This control cuts both ways, and that is a crucial point. Cleaning tag characters out of email before a filter sees them also cleans them out before an AI assistant reads the same inbox. An assistant that is connected to email could otherwise be vulnerable to hidden instructions buried in incoming messages. The same normalization step that defeats spam obfuscation also protects AI systems from a well-known class of prompt injection.

OpenAI took a blunter approach in June by introducing Lockdown Mode for ChatGPT, a feature designed to prevent hidden instructions in attachments and web content from being executed. That product-level control addresses the AI side of the problem, while email filtering addresses the spam side. Both approaches recognize that invisible characters create a gap between what a human perceives and what a machine interprets.

The crossover is the real lesson of this episode. Security techniques do not remain confined to the domain that made them famous. ASCII smuggling took about a year to travel from red-team write-ups and AI research papers to bulk email spam, and by the time it arrived, it had lost the part that made it interesting. There were no hidden prompts instructing an AI to leak secrets. There was only a hidden character inside the word 'funding,' quietly breaking a filter rule.

Source: TNW | Data-security News