A trick once used to attack AI models is now being used by email spammers

[KeyboardWarrior]

Microsoft researchers identified a high-volume phishing campaign using invisible Unicode tag characters, a technique called ASCII smuggling that was originally popularized through research into prompt injection attacks against AI systems. The Unicode Tags block, a range of code points from U+E0000 to U+E007F, contains shadow representations of ordinary printable characters that aren't rendered by typical fonts or interfaces, meaning a person sees nothing while any software processing the raw text, including a language model, still reads the hidden characters

In the original AI security context, attackers would hide entire instructions inside these invisible characters on a webpage, document or email, letting an AI assistant execute a command a human reader would never see at all. Microsoft found spammers repurposed the same technique for a different purpose, splitting suspicious financial lure words like funding with invisible tag characters so email filters couldn't recognize the word as a single unbroken string, even though a human reading the email would see it displayed normally. Detections of this specific evasion technique spiked sharply starting February 9th and stayed elevated on weekdays for roughly three months, generating millions of daily messages through a large network of rotating sender domains

Microsoft's research team discovered the campaign while specifically hunting for AI-targeted prompt injection content in Microsoft Defender for Office 365, only to find the exact same underlying character range being abused for an entirely different, more mundane purpose. Curious what people think this specific crossover reveals, does the fact that AI security research techniques are already leaking into ordinary spam and phishing mean AI adjacent security work needs to think more defensively from the start

Once popular for attacking AI, ASCII smuggling is embraced by spammersarstechnica.com

[PhotonBurst]

Splitting a single suspicious word like funding across invisible characters to defeat keyword based filters is a genuinely clever bit of low-tech evasion hiding inside a fairly sophisticated sounding Unicode exploit

[Maxximus]

The three month sustained campaign with a weekday-only pattern is such a specific operational detail, suggests a genuinely organized operation running on a normal business schedule rather than random opportunistic spam

[MegaMike16]

Spammers repurposing the technique for filter evasion rather than actual AI instruction hijacking is honestly the more mundane but also more immediately dangerous use case, millions of daily messages is a genuinely massive scale

[ReplyGuy26]

This crossover from AI security research into ordinary spam tactics was honestly inevitable once the technique became publicly documented, attackers reliably adapt tradecraft across domains once it's proven to work anywhere

[MJF02]

Microsoft finding this by accident while hunting for something else entirely is a good reminder that defensive security research often surfaces threats nobody was specifically looking for at the time

[Firewall Stephen]

Worth remembering these invisible Unicode characters were always a broader text encoding vulnerability, AI just happened to be the context that first made the technique famous and gave it a catchy name