Invisible Unicode trick jumps from AI prompt injection to phishing, Microsoft says
Microsoft says attackers used invisible Unicode tag characters, a trick known from AI prompt injection, to split finance-bait words and slip past email filters.
A technique out of artificial intelligence security research has turned up in ordinary email crime. In a post dated 3 September 2026, Microsoft Security Research says it observed a high-volume phishing campaign that hid content inside invisible Unicode tag characters, the method prompt-injection researchers call "ASCII smuggling".
What the technique actually is
ASCII smuggling hides content inside normal-looking text using invisible Unicode characters never drawn on screen. The most abused range is the Unicode Tags block, U+E0000 to U+E007F, a shadow copy of printable ASCII: U+E0041 mirrors "A", U+E0061 mirrors "a". Largely obsolete since its language-tagging days, the block goes unrendered by most fonts and interfaces, so text can carry a message a person cannot read but software will process.
That made it a fixture of prompt injection and cross-prompt injection (XPIA) research: instructions hidden in tag characters look unremarkable to a human, while an assistant reading the raw text decodes them and can be steered toward data leakage or unauthorised actions.
The direction has flipped
What is new, Microsoft says, is the purpose. The characters were not hiding an instruction from a person to show it to a model; they split finance-bait words such as "funding" so email filters could not parse them. The goal is inverted, the mechanism identical: the trait that slips instructions past a person into a model, the blog notes, also slips keywords past a detector.
The finding came out of Microsoft Defender for Office 365 work on prompt injection protection. Hits on a hunting signature for ASCII smuggling rose sharply on 9 February 2026 and stayed high on weekdays for about three months, the window the report covers; most flagged messages, Microsoft says, were caught by layered protections, not a single Unicode-specific signal. On X, Microsoft Threat Intelligence tied the same telemetry to a months-long, large-scale, finance-themed operation using hundreds of rotating sender domains.
Techniques that surface in AI security research, the post argues, spread quickly to conventional campaigns. The practical consequence for defenders: strip invisible characters before text reaches a model or a filter, and lean on layered protection rather than one signature. Sources: the Microsoft security blog and the announcement on X.
