Invisible Unicode tags: spammers adopt ASCII smuggling to slip past filters
Microsoft says ASCII smuggling, once used to hide prompt injections from AI agents, is now a spam tactic, with daily detections jumping from 21,000 to 2.5 million.
A technique built to hide malicious prompts from humans while feeding them to AI agents is now in the hands of spammers. In a post published Thursday, Microsoft said ASCII smuggling is being used to evade the filters email platforms rely on to flag unwanted bulk messages.
The method drew attention two years ago as a way to make prompt injection attacks stealthier. Instead of ordinary text, instructions are written using a special range of Unicode tag characters. The code point U+E0041 mirrors "A" and U+E0061 mirrors "a". The block of 128 tags copies part of ASCII almost perfectly, with one crucial difference: computers can read the characters, but by design they are nearly invisible to people. A language model picks up the instruction; the person reading the email sees nothing.
From 21,000 to 2.5 million a day
Microsoft recorded a sharp rise in spam using the trick earlier this year. Starting one day in early February, ASCII smuggling signatures detected by Microsoft Defender for Office rose from roughly 21,000 per day to more than 1.3 million. Four days later the count reached 2.5 million. The wave lasted for months before dropping off sharply in mid-May.
"Because tag characters are invisible to humans but exist at the text-processing level, the same property that makes them useful for smuggling instructions into a model also makes them useful for obfuscating keywords before a detector evaluates them," Microsoft wrote. "The intent is inverted, but the mechanism is similar, and a user's suspicions are not raised."
Breaking the tokenizer
Spammers target filters that scan for dollar amounts and terms such as "credit" and "term" that recur in mass mail. Drop invisible characters into the middle of "funding" and a filter may read "fun" and "ding", while the recipient still sees "funding".
Camouflaging trigger words is an old trick: zero-width and non-breaking spaces have served the same purpose for decades, defeating literal string matches and altering the byte sequences regex filters look for. Some spam filters had not yet been taught to spot the Unicode tags, but the larger target is the machine learning and natural language processing models that increasingly drive spam and phishing classification. Unless a filtering system renders the message as an image and runs OCR, it may miss the attack. Classifiers split text into tokens or sub-word pieces, so inserting an invisible U+E0020 can break a familiar unit into "fun", a stray tag character and "ding", emit rare or unknown sub-tokens, or, if normalization runs first, simply be stripped, restoring "funding".
Microsoft's post also offers guidance for developers on programming filters to account for the technique. Full details are in the Ars Technica report.
