Abstract:
A stealth technology that was originally famous for artificial intelligence jailbreaking and prompt word injection attacks - "ASCII Smuggling" - has now been abused on a large scale in spam and phishing activities. Microsoft's security research team revealed that cyber attackers are using this method to bypass mainstream email gateways and anti-spam systems and deliver fraudulent messages to millions of mailboxes.
The core principle of "ASCII smuggling" is to use special Unicode characters that are invisible or not rendered by the human eye in modern text encoding standards to embed hidden information into seemingly normal text. The most commonly abused method is the Unicode "Tags block" (coding range is U+E0000 to U+E007F). This block was originally designed for language markup and is now largely abandoned. It contains "shadow images" of standard printable ASCII characters (for example, U+E0041 corresponds to the uppercase letter A). When viewed by the human eye or most conventional interfaces, these characters are completely invisible and do not display any visual content; however, the underlying parsing software and artificial intelligence large language model can still recognize and process these hidden texts when reading the original character stream. Previously, hackers often used this mechanism to secretly "smuggle" malicious instructions into the AI processing process, inducing the AI assistant to leak private data or perform unauthorized operations without the user's knowledge.
However, when the Microsoft research team was developing a prompt word injection protection signature library for its Defender for Office 365 system, it accidentally detected the disguised application of this AI attack weapon in traditional online fraud. Telemetry data shows that starting from February 9, 2026, the number of captures of this Unicode tag feature has shown explosive growth. The number of detections in a single day has instantly soared from thousands to tens of thousands in the past to more than 1.3 million, and reached a peak of more than 2.37 million in a single day in late February. This high-frequency attack trend lasted for three full months during working days, showing the characteristics of very regular automated and large-scale distribution.
The investigation shows that the attacker did not try to inject attack instructions into the AI this time, but used it as an ultimate "text salting" obfuscation method. In traditional phishing defense, anti-spam filters rely heavily on sensitive words and rule signatures to intercept fraudulent emails. In the past, spam emails often used zero-width spaces (U+200B) or non-breaking spaces (U+00A0) to break up sensitive words, but such characters have been basically universally defended by modern security gateways. In this operation, the fraud gang turned to using unpopular Unicode tag characters (such as the invisible tag space U+E0020) and quietly inserted them into financial fraud keywords such as "loan", "financing", and "credit". Since the existence of these characters cannot be detected by the naked eye, ordinary recipients see smooth and natural copywriting; however, traditional security engines based on string matching will be completely ineffective because the words are forcibly cut off at the bottom layer.
What’s even more troublesome is that this obfuscation method can also interfere with the new generation of intelligent email security detection systems based on large language models (LLM). When the AI security model performs tokenization on emails, the inserted special Unicode characters will directly disrupt the semantic understanding of the tokenizer, making it impossible for the model to accurately splice and determine contextual malicious features, thus forming a defense blind spot.
In the wave of attacks disclosed this time, attackers focused on financial baits such as small business financing loans, registered a large number of discardable email domain names containing specific financial terms, and cleverly abused the infrastructure and link jump rewriting function of the legitimate email marketing platform ActiveCampaign to hide the real malicious jump domain names and avoid direct blocking at the IP level.
Security experts pointed out that this covert penetration tactic originally targeted at large cutting-edge AI models has now been fully absorbed by black industries and transformed into an industrial-grade weapon against daily corporate defenses. This also highlights that as artificial intelligence is deeply intertwined with modern character standards, the boundaries between cyber attack and defense dimensions are becoming increasingly blurred. In response to such emerging threats, security agencies recommend that email system administrators and security vendors must add special pre-processing steps before performing text matching and model semantic analysis to thoroughly clean and normalize Unicode tag blocks and invisible control characters, so that malicious features hidden in the void are invisible.
Comments