ASCII smuggling technique migrates from AI attacks to spam campaigns
Original: Once popular for attacking AI, ASCII smuggling is embraced by spammers
Why This Matters
Demonstrates how AI-targeting exploits rapidly migrate to broader cybersecurity threats like spam evasion.
Microsoft reported in September 2026 that ASCII smuggling — a Unicode-based technique originally used to hide malicious prompts from AI agents — is now being exploited by spammers to evade email filters. Daily detections by Microsoft Defender for Office surged from ~21,000 to 2.5 million within four days in early February 2026.
ASCII smuggling uses a block of 128 Unicode tag characters (e.g., U+E0041 mirroring 'A') that are readable by computers but invisible to humans. Originally documented as a tool for stealthy prompt injection attacks against LLMs, the technique has been repurposed by spammers to bypass keyword-based email filters.
Microsoft observed a sharp spike in ASCII smuggling signatures detected by Microsoft Defender for Office starting in early February 2026. Detections jumped from approximately 21,000 per day to over 1.3 million within one day, then reached 2.5 million within four days. The campaign persisted for months before dropping off sharply in mid-May 2026.
Spammers embed invisible Unicode tag characters within common trigger words — for example, inserting hidden characters into 'funding' so that filters read 'fun' and 'ding' separately, while the human recipient sees the complete word. Finance-themed sender domains were notably targeted throughout the campaign period (February 9 – June 18, 2026).
Microsoft noted in its Thursday disclosure: 'The intent is inverted, but the mechanism is similar, and a user's suspicions are not raised.' The company emphasized that the same property making these characters useful for AI prompt injection also makes them effective for keyword obfuscation against spam detectors.