Threat actors have repurposed an AI prompt-injection technique known as ASCII smuggling to evade email security controls at massive scale, hiding invisible Unicode characters within financial phishing lures.
Microsoft observed the activity reach more than 2.3 million messages per day, demonstrating how techniques first popularized in AI-security research can quickly migrate into conventional phishing operations.
The campaign inserted invisible characters from Unicode’s largely deprecated Tags block, U+E0000 through U+E007F, into high-value financial keywords such as “funding,” “loan,” and “credit.”
The word still appeared normal to a recipient. However, its underlying text sequence changed enough to potentially disrupt literal keyword matching, tokenization, and some NLP-driven detection models.
For example, an email could visually present the word “funding” while encoding it as fun⟨U+E0020⟩ding, with the non-rendering Unicode TAG SPACE placed between letters.
A user sees an ordinary business-finance offer; a scanner that does not normalize the character before inspection may fail to recognize the uninterrupted keyword.
In that context, attackers hide machine-readable instructions in webpages, documents, or emails, leaving the content invisible to a human but potentially readable by an AI assistant processing raw text.
The Unicode Tags block effectively contains shadow representations of printable ASCII characters.
Because most of these code points are not rendered by typical user interfaces, they provide a gap between what a person sees and what software processes.
Microsoft’s research began as a hunt for email-borne prompt-injection content in Microsoft Defender for Office 365.
A detection signature designed to identify hidden Unicode tag characters instead uncovered a large financial-themed phishing operation abusing the same range for filter evasion rather than to smuggle instructions into an AI model.
That distinction matters. The attackers did not appear to encode a separate hidden message. Instead, they used isolated invisible tag characters to split phishing terms that defenders would normally treat as suspicious.
Microsoft telemetry showed a sharp increase in ASCII-smuggling signature detections on February 9, 2026.
The detection fired on roughly 21,000 messages the previous day, then surged to more than 1.3 million messages. Volumes later exceeded 2.3 million messages in a single day.
The high-volume phase continued for approximately three months, with a clear weekday-only operating pattern.
Campaign traffic dropped sharply on weekends, especially Sundays, before returning to full volume on subsequent workdays.
This regular cadence is consistent with scheduled bulk-email infrastructure rather than opportunistic, low-volume phishing.
The activity declined substantially after May 15, although lower-level residual traffic and periodic spikes continued into June.
Microsoft Researchers said that, ASCII smuggling became prominent through research into prompt injection and cross-prompt injection attacks against AI systems.
Microsoft linked the Unicode-tag phase to a broader ActiveCampaign-delivered phishing campaign previously documented by Fortra, indicating the operation existed before it adopted this particular evasion method.
AI-Era ASCII Smuggling
The observed messages primarily used disposable, finance-themed sender domains assembled from recurring words such as “capital,” “funding,” “loan,” “growth,” “boost,” and “finance.”
Examples included guardiangrowthfunding[.]com, digitalcapitalboost[.]com, and thebusinessloanexpress[.]com.
The campaign’s emails were relayed through infrastructure associated with ActiveCampaign, a legitimate email-marketing platform.
Links were commonly rewritten through the service’s click-tracking domains, including acemlnd[.]com and activehosted[.]com, which can make messages resemble legitimate marketing traffic and complicate reputation-based filtering.
Microsoft found that about 96% of flagged messages were associated with the finance-themed campaign cluster. Most traffic also originated from infrastructure consistent with the marketing platform’s shared sending environment, including the 173.236.20[.]0/24 network range.
That range should not be treated as a standalone malicious indicator because it belongs to legitimate shared infrastructure.
ActiveCampaign said it tested the technique against its content-moderation systems and found that emails containing invisible Unicode characters received the same verdict as unobfuscated equivalents.
The company added that heavy use of the technique itself is treated as suspicious and that it continues to improve abuse detection across the customer account lifecycle.
The key defensive principle is to normalize before matching. Email-security pipelines should strip, fold, or normalize invisible and non-rendering Unicode characters before applying keyword rules, regular expressions, tokenization, or phishing-classification logic.
Defenders should specifically monitor for Unicode Tags block characters, particularly U+E0020, in email subjects and bodies.
These characters are rare in legitimate communications, although detections should account for subdivision-flag emoji sequences used for England, Scotland, and Wales, which also rely on Unicode tag characters.
Microsoft noted that more than 99% of the observed malicious messages were detected by layered Defender protections that did not depend solely on Unicode-tag detection.
Those layers included sender, IP, URL, and domain reputation; machine-learning spam and phishing classification; brand-impersonation detection; authentication checks; and visible-text extraction through OCR.
The case highlights an emerging cross-domain threat trend: AI-era evasion research is no longer limited to AI systems.
Techniques developed to manipulate how language models interpret content can also help attackers obscure phishing text from traditional security tooling, making Unicode normalization and layered detection increasingly important across both email security and AI ingestion workflows.
IOCs
| Indicator | Type | Description |
| Characters in range U+E0000-U+E007F in email subject/body | Content pattern | Unicode tag-block characters spliced into spam/phishing keywords to evade signatures. |
| Finance-themed disposable domains (capital, fund, funding, loan, loc, lend, finance, business, express, growth, solutions, choice, pillar) | Sender domain pattern | Bulk-registered, rotating sender domains used by the campaign. |
| Envelope (P1) sender shaped em-<digits>.<brand> or shared pool acems<N>[.]com / emsd<N>[.]com | Infrastructure pattern | Reputation-laundering relay through a legitimate email-marketing platform. |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
