Security Reports disagree 4 publishers 2 min read Published Sep 3, 2026, 10:43 AM PDT Updated Sep 6, 2026, 11:07 AM PDT

Phishing crews adopt the AI red team's invisible Unicode trick to break keyword filters

A hunting signature Microsoft built to catch prompt injection in email started firing on ordinary phishing instead, where invisible tag characters were splitting lure words like "funding" so filters never parsed them.

The Watch · Security desk

Send a correction

What happened

Microsoft says it observed a high-volume phishing campaign built on invisible Unicode tag characters, the ASCII smuggling technique popularized by AI prompt injection research.
The characters were used to split financial lure words such as "funding" so that email filters could not parse them, rather than to hide instructions for an AI model.
The discovery came out of Defender for Office 365 prompt injection protection work, where a hunt written for email-borne cross-prompt injection surfaced the phishing use instead.

Why it matters

What's now possible capability Any detector that matches on visible keywords can now be stepped around without changing what the recipient reads, which moves the bypass out of the message text and into the encoding.
What it costs cost Defenders inherit Unicode normalization work in every text-matching path plus the false-positive tuning that comes with it, and the flag-emoji case shows that bill lands before any attacker traffic does.
What it sets up precedent Techniques stress-tested in AI red teaming are arriving as commodity filter evasion, so prompt injection research now doubles as a preview of conventional phishing tradecraft.
What it limits constraint Benign tag characters from gateways, providers and researchers mean the signal only works as a spike detector against a known baseline, not as a standalone block decision.

Next story · Product · Sep 6

Spammers borrowed the prompt-injection character block to split "funding" in half

Confirmed2 publishers

The evasion turns on the gap between the string a person reads and the string a matcher tokenizes. Drop code points from the Unicode Tags block between the letters of a lure word and the message still reads normally to the recipient, because typical fonts and interfaces do not draw those code points ^[5], while the rule looking for "funding" has nothing left to match ^[2]. The block is a shadow copy of printable ASCII, so there is an invisible twin of every letter: U+E0041 for "A", U+E0061 for "a" ^[4]. The range holds 128 code points ^[12], deprecated language-tagging leftovers that sit in text-processing paths most detection content was never written to normalize ^[4].

The AI security literature made the same block famous running the technique the other way: hidden instructions that a human never sees and an assistant ingesting raw text decodes and may act on, up to data exposure depending on its permissions ^[7]. That pattern filled red-teaming write-ups, talks and tooling through 2025 ^[6]. Microsoft's hunt was built for that problem, as part of Defender for Office 365 prompt injection protection, and it is the hunt that surfaced the phishing use ^[10]. Intent inverted, mechanism unchanged.

Dates. Signature hits climbed sharply from 9 February 2026 and stayed elevated on weekdays for roughly three months ^[3], which puts the end of that window near 9 May. Microsoft published on 3 September 2026 ^[8], close to four months after the elevated stretch and about seven months after onset ^[13]. The weekday shape is worth keeping in mind: mail sent on a work calendar, into work inboxes.

The tuning story is the part detection teams will pay for. Version one flagged any code point in the range and was too blunt, firing on legitimate mail carrying the England, Scotland and Wales flag emojis, which are themselves encoded with tag characters ^[11]. After those exclusions the residue was gateways, mailbox providers and researchers forwarding test messages, which is a baseline rather than a verdict, useful because spikes stand out against it ^[14].

Two limits on the read. Microsoft says most of these messages were caught by layered protections, not by the Unicode signal alone ^[9], so stacks were not blind here. And the write-up names no actor and gives no message counts ^[15]. This is a technique report on a filter bypass, not an attribution.

What to watch

Whether tag-character volumes return after the roughly three-month window Microsoft describes, or move to other non-rendering code point ranges.
Whether Microsoft or another vendor puts an actor name and a message count against this campaign.
Whether non-Microsoft mail gateways start normalizing Unicode before keyword matching, or keep matching on raw text.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence64
Adoption72
Hype gap+16
Incentives74
Confidence66

Perspective Coverage

4 publishers

Builder: Builder 31%
Operator: Operator 60%
Investor: Investor 9%

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Microsoft researchers observed a high-volume phishing campaign using invisible Unicode tag characters, a technique popularized in AI prompt injection research as ASCII Smuggling.
Reported SupportedView cited source
[2]
Instead of hiding instructions from people while exposing them to AI models, the attacker used the tag characters to split financial lure words such as 'funding' to prevent email filters from parsing them.
Reported SupportedView cited source
[3]
In Microsoft telemetry, hits on a hunting signature designed to detect ASCII smuggling increased sharply beginning February 9, 2026, and remained elevated on weekdays for approximately three months.
Reported SupportedView cited source
[4]
The most abused range is the Unicode Tags block, U+E0000 to U+E007F, which contains a shadow copy of the printable ASCII characters (U+E0041 mirrors 'A', U+E0061 mirrors 'a'); it was originally intended for language tagging and is now largely deprecated.
Reported SupportedView cited source
[5]
Most of these code points are not rendered by typical fonts and user interfaces, so a string can carry a message unreadable to a human but processed by any language model or other software that receives a copy of the email content.
Reported SupportedView cited source
[6]
Over the past year ASCII smuggling became a recurring technique in the prompt injection and cross-prompt injection literature, appearing frequently in AI red-teaming write-ups, conference talks and tooling throughout 2025.
Reported SupportedView cited source
[7]
In the prompt injection pattern, an attacker hides instructions inside invisible tag characters in a page, document or email; the human and many interfaces see nothing unusual; an AI assistant that ingests the raw text decodes the characters and may be induced to follow attacker-controlled instructions, potentially including data exposure or unauthorized actions depending on the assistant's permissions and safeguards.
Reported SupportedView cited source
[8]
Microsoft published the research on 3 September 2026.
Reported SupportedView cited source
[9]
Microsoft Defender for Office 365 telemetry showed that the majority of messages were flagged by layered protections rather than by reliance on a single Unicode-specific signal.
Reported SupportedView cited source
[10]
The finding emerged from Microsoft Defender for Office 365 prompt injection protection research; hunting logic built for email-borne cross-prompt injection and prompt obfuscation became the starting point for the phishing-evasion discovery.
Reported SupportedView cited source
[11]
The first version of the signature flagged any code point in the U+E0000-U+E007F range and proved too blunt, repeatedly firing on a small subset of legitimate messages that all contained one of three subdivision flag emojis - England, Scotland and Wales - because those emojis are encoded using tag characters.
Reported SupportedView cited source
[12]
The Unicode Tags block spans 128 code points.
Derived Supported
[13]
The roughly three-month elevated window that began 9 February 2026 ends near 9 May 2026, making the 3 September 2026 publication close to four months after that window and about seven months after onset.
Derived Supported
[14]
After the flag-emoji exclusions, remaining hits were mostly benign artifacts from email-security gateways, mailbox providers, and security or AI researchers forwarding or testing messages containing tag characters, providing a baseline against which spikes would indicate abuse.
Reported SupportedView cited source
[15]
The Microsoft write-up describes the campaign as high-volume but names no threat actor and reports no message counts or target geography.
Reported ContestedView cited source

Sources

4 independent publishers whose own reporting we read for this story.

bleepingcomputer.com
2 articles · September 6, 2026
Attackers conceal phishing lures using invisible Unicode characters
microsoft.com
1 article · September 3, 2026
ASCII smuggling crosses over from AI prompt injection to phishing evasion
scworld.com
1 article · September 4, 2026
ASCII smuggling challenges email phishing filters, Microsoft warns
thehackernews.com
2 articles · September 5, 2026
Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder31%

For anyone building text pipelines, the transferable content sits in two places. Microsoft's account of writing the signature is a short lesson in Unicode edge cases: match the whole Tags block and you will trip over the England, Scotland and Wales flag emojis, which are encoded as invisible tag sequences, plus a steady trickle of gateways and researchers passing test payloads around. SC Media carries the second half, which the other outlets skip — the same insertion that breaks a regex also splits tokens, so an LLM-based mail scanner never assembles the word it was meant to judge. The fix in both cases is ordering: strip or normalise tag characters and other invisible code points before content reaches a signature, a tokeniser or an assistant.

Operator60%

The usable indicators are spread across three outlets rather than concentrated in one. BleepingComputer has the tightest scoping: 148 finance-themed sender domains behind roughly 96% of flagged messages, and over 99% caught on sender, IP and reputation signals anyway. The Hacker News has the domain list and the ActiveCampaign relay path through acemlnd and activehosted. SC Media adds the corroborators — 28 recurring domain words, about 98.5% matching ActiveCampaign's shared sending envelope pattern, 92% from a single /24 — together with Microsoft's warning that platform-tied signals prove abuse of a legitimate service, not the identity of a group. Two dates set expectations: the tag-character volume fell away after 15 May 2026, and the operation behind it is described as still running without the trick.

Investor9%

There is almost nothing here for a capital reader, and pretending otherwise would be padding. No funding, pricing or market figures appear in any account. What a commercial reader can take is narrower: a shared email marketing platform found itself named as the delivery path for millions of finance-lure messages and had to put a moderation statement into a rival vendor's blog post, and a detection vendor turned its AI-safety research budget into a demonstration that the same hunting logic pays off against ordinary spam. Both sit squarely in the reputational column, with no dollar figure attached to either.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence64: 0100
One sensor network, unusually legible method
Everything countable in this story comes out of a single pipeline, Microsoft Defender for Office 365, and the three outlets covering it are restating rather than measuring. What lifts it above the usual vendor telemetry is that the method is shown: the false positives from three flag emojis, the benign residue of gateways and researchers, the baseline those exclusions produced. A reader can see how the numbers were arrived at without being able to check them.
Adoption72: 0100
Attackers have numbers, defenders have a gap
As attacker adoption this is well documented for a three-month window: millions of messages a weekday, 148 finance-themed sender domains behind about 96% of flagged mail, delivery through a legitimate marketing platform's shared sending pool. The other side of adoption is bare. Normalising tag characters before signatures and before model input is a recommendation, and no source shows anyone outside Microsoft having implemented it.
Hype gap+16: −100 understated0 aligned+100 overstated
Bypass framing outruns the delivered harm
Three of the four accounts frame this as filters being evaded at multi-million-message scale. The number that qualifies it is in Microsoft's second paragraph and BleepingComputer's fifth: over 99% of the mail was flagged anyway on sender, IP and reputation grounds. The trick defeated literal keyword matching and nothing else anyone has demonstrated, it stopped appearing in volume in mid-May, and the write-up landed in September. The technique is real and the mechanism matters for AI-fed pipelines; the alarm still runs slightly ahead of the damage on record.
Incentives74: 0100
Discovered and blocked by the same vendor
The company reporting the technique sells the product that caught it, and the post doubles as evidence that its prompt-injection hunting work earns its keep on ordinary phishing. ActiveCampaign, named as the delivery path, gets a paragraph in the same research to say its moderation already handles invisible characters. BleepingComputer's version closes on a pitch for an unrelated vendor's simulation report. None of that makes the Unicode mechanics wrong — those are checkable by anyone with a mail corpus and a code-point inspector — but no disinterested party appears anywhere in this story.
Confidence66: 0100
Mechanism holds up; volume figures remain unverified
The technical spine can be verified by hand: paste a Wales flag emoji into any code-point inspector and the invisible tag sequence spelling gbwls is there, exactly as Microsoft shows. That makes the mechanism, the block's deprecated origin and the invisibility property hard to dispute. The counts, dates and domain cluster are a different order of claim — single-vendor telemetry passed down through three outlets — and the absence of any named actor leaves the who unresolved. Hence a reading above the middle rather than high.

Topics and entities

Topics

Email security filtering
Detection Engineering
Prompt injection