> ## Content Index
> Fetch the complete content index at: https://globalfeed.ai/llms.txt
> Use this file to discover other available public pages before exploring further.

# Invisible Unicode trick jumps from AI prompt injection to phishing, Microsoft says
- URL: https://globalfeed.ai/en/invisible-unicode-trick-jumps-from-ai-prompt-injection-to-phishing-microsoft-says/
- Published: 2026-09-03T20:18:08.000Z
- Updated: 2026-09-03T20:19:51.000Z
- Description: Microsoft says attackers used invisible Unicode tag characters, a trick known from AI prompt injection, to split finance-bait words and slip past email filters.
- Author: GlobalFeed Editor
- Tags: Microsoft, ascii-smuggling, prompt-injection, phishing, unicode, x-MsftSecIntel, dil-en, elle, x-gitti, video

A technique out of artificial intelligence security research has turned up in ordinary email crime. In a post dated 3 September 2026, Microsoft Security Research says it observed a high-volume phishing campaign that hid content inside invisible Unicode tag characters, the method prompt-injection researchers call "ASCII smuggling".

## What the technique actually is

ASCII smuggling hides content inside normal-looking text using invisible Unicode characters never drawn on screen. The most abused range is the Unicode Tags block, U+E0000 to U+E007F, a shadow copy of printable ASCII: U+E0041 mirrors "A", U+E0061 mirrors "a". Largely obsolete since its language-tagging days, the block goes unrendered by most fonts and interfaces, so text can carry a message a person cannot read but software will process.

That made it a fixture of prompt injection and cross-prompt injection (XPIA) research: instructions hidden in tag characters look unremarkable to a human, while an assistant reading the raw text decodes them and can be steered toward data leakage or unauthorised actions.

## The direction has flipped

What is new, Microsoft says, is the purpose. The characters were not hiding an instruction from a person to show it to a model; they split finance-bait words such as "funding" so email filters could not parse them. The goal is inverted, the mechanism identical: the trait that slips instructions past a person into a model, the blog notes, also slips keywords past a detector.

The finding came out of Microsoft Defender for Office 365 work on prompt injection protection. Hits on a hunting signature for ASCII smuggling rose sharply on 9 February 2026 and stayed high on weekdays for about three months, the window the report covers; most flagged messages, Microsoft says, were caught by layered protections, not a single Unicode-specific signal. On X, Microsoft Threat Intelligence tied the same telemetry to a months-long, large-scale, finance-themed operation using hundreds of rotating sender domains.

Techniques that surface in AI security research, the post argues, spread quickly to conventional campaigns. The practical consequence for defenders: strip invisible characters before text reaches a model or a filter, and lean on layered protection rather than one signature. Sources: the [Microsoft security blog](https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/?ref=globalfeed.ai) and the [announcement on X](https://x.com/MsftSecIntel/status/2095549879049224358?ref=globalfeed.ai).