Cyber criminals are adapting ASCII smuggling for mass phishing campaigns

Microsoft has warned that ASCII smuggling, the use of invisible Unicode characters to trick AI models, is now being used by cyber criminals to supercharge phishing campaigns.

Over the past year, ASCII smuggling has become a recurring technique for prompt injection and cross-prompt injection (XPIA), allowing an attacker to hide instructions inside invisible tag characters embedded in a web page, document, email, or other content.

While human beings - and many user interfaces - see nothing unusual, an AI assistant that ingests the raw text registers the hidden characters, decodes them as text, and can be induced to carry out unauthorized instructions, including data exposure.

The most abused range is the Unicode Tags block, U+E0000 to U+E007F, which contains a shadow copy of the printable ASCII characters. For example, U+E0041 mirrors ‘A’, U+E0061 mirrors ‘a’). The block was originally intended for language tagging and is now largely deprecated.

According to Microsoft, hits on a hunting signature designed to detect ASCII smuggling increased sharply on February 9, and stayed high on weekdays for the next three months.

This time, though, the technique appears to be in use as part of a broader phishing campaign that was identified by Fortra this time last year.

"When we looked at a sampling of the flagged messages, the surprise was there were no smuggled instructions to an AI assistant. Instead, the invisible tag characters were inserted inside common financial keywords, splitting them apart so that a literal signature or keyword match would fail," the researchers said.

"For example, a finance lure term that appeared normal to the recipient could be transmitted with an invisible tag character in the middle: funding became 'fun⟨U+E0020⟩ding'.

To the recipient, and to parsing pipelines that drop or normalize these characters, the word still reads as 'funding'. Microsoft warned that unless a filtering system takes a picture of a message and does OCR extraction over the visual image, it may miss this type of attack.

ASCII smuggling campaign hit hundreds of domains

According to Microsoft, the campaign ran on hundreds of disposable, finance-themed sender domains with lures that resembled business loan, line-of-credit, and advance-funding phishing patterns often associated with fraud or credential-harvesting funnels.

This pattern accounted for roughly 96% of the volume flagged by the hunting signature. The emails in question were relayed through infrastructure associated with the legitimate email-marketing platform, ActiveCampaign.

"We appreciate Microsoft’s research and welcome collaboration with the security community to combat this activity. We take abuse, fraud, and security extremely seriously," said an ActiveCampaign spokesperson.

"We tested the specific technique described in this research against our content-moderation systems: messages containing invisible Unicode characters receive the same moderation verdicts as their unobfuscated equivalents, and heavy use of the technique is itself treated as a suspicious signal."

How to protect yourself against ASCII smuggling

To stay safe, Microsoft said organizations should strip or normalize Unicode tag characters (U+E0000-U+E007F) – and other zero-width / invisible code points – from email subject and body text before applying spam and phishing content signatures.

The presence of tag-block characters should be seen as a strong red flag: they're rare in ordinary mail and can be a high-value anomaly signal.

They should also look for the behavioral fingerprint: bulk volume from churning, finance-themed disposable domains, on a strict weekday-on/weekend-off schedule.

Elsewhere, businesses are advised to apply the same normalization upstream of AI ingestion: the same control that defeats this evasion also reduces XPIA / ASCII-smuggling exposure for AI assistants that ingest email content, Microsoft said.

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.