Spammers split "funding" with an invisible Unicode tag to slip past keyword filters
The Unicode tag block was a jailbreak trick before it was a spam trick. Microsoft's signature for it went from 21,000 hits in a day to more than 2.3 million three days later, and NFC normalization does not strip it.
The Engineer · Build desk
What happened
- Microsoft flagged a phishing campaign in which attackers slip invisible Unicode tag characters into email bodies, where they do not render on screen but change the underlying string that software processes.
- In the campaign tracked by Defender for Office 365 the tags sat inside high-signal words such as funding, loan and credit so keyword filters lost the exact match, not to smuggle instructions into a model.
- Microsoft says attackers are using the technique at scale to bypass spam filters and ML-based classifiers, and that AI systems ingesting external text face the same primitive.
Why it matters
- What doesn't add up contradiction The dev.to account reads this as a jailbreak technique arriving in the inbox and concedes the mechanics were not detailed; The New Stack's mechanics are keyword evasion, so a filter tuned for hidden instructions would let this traffic through.
- Who has to decide decision Every text boundary now needs an explicit rule for the U+E0000 to U+E007F range, and anything that legitimately renders subdivision flags cannot take the cheap option of deleting the whole block.
- What it limits constraint Check-then-forward designs stop working here, because validating a tag-free copy and passing the original downstream inspects a string the model never reads.
- Who's exposed exposure Agents triaging tickets and scraped pages inherit the primitive without the fallback signals a mail provider keeps, so the same bytes buy more there than they do in email.
Next story · Leadership · 5d ago
Calendar phishing reaches staff through auto-added invites even when the email lands in spamConfirmed2 publishers
The payload in the Defender for Office 365 campaign carries no instruction. It is a word break. Put U+E0020 between "fun" and "ding" and a person still reads "funding" while a filter looking for that string finds nothing to match [9][8]. Nothing has to be interpreted for the evasion to land, which is why Microsoft says it works against spam filters and ML-based classifiers alike [17].
That is where the two accounts pull apart. The dev.to writeup reads the campaign as the jailbreak primitive graduating into commodity abuse, and says plainly that the exact mechanics were not detailed in the reporting it saw [6][7]. The New Stack has the mechanics, and they are not injection: tag characters inside "funding", "loan" and "credit" so that exact matches fail, while recipients see ordinary business loan and credit offers [8][11]. The primitive travelled downstream while the objective changed on the way.
If your ingest path calls Unicode normalization and treats the result as sanitized, check what those forms promise. NFC and NFD reconcile different representations of the same character; they were not built to remove tag characters, and per The New Stack the tags survive both [12]. Deleting the U+E0000 to U+E007F range is a separate, explicit step [4]. Tokenizer behaviour after that is not uniform either, since some tokenizers ignore the tag and others resplit the surrounding text, so the only useful test is against the tokenizer you actually ship [14].
The volume figures come from Microsoft's own mail flow, and they count signature hits [10]. About 21,000 the day before the campaign to more than 1.3 million the next day is roughly a 62-fold jump [15]; past 2.3 million two days after that is about 110 times the pre-campaign day [16]. For that curve to mean anything in your environment, your mail path would need comparable exposure to this campaign and the signature would need to be specific. Microsoft's own experience argues for care on the second condition: the first version of the hunting signature matched the England, Scotland and Wales subdivision flag emojis, which are assembled from invisible tag sequences, until the team carved out an explicit exception [13]. A 21,000-hit baseline recorded before the campaign started is consistent with a signature that also fires on text nobody sent in anger.
One recommendation costs real work. Whatever you strip has to stay stripped for the rest of the pipeline, because comparing the original against a tag-free copy and then handing the untouched original to the model validates a string the model never reads [5]. A second design choice, from the dev.to piece that doubles as a pitch for a filter called Sentinel, is worth taking regardless of the pitch: obfuscation found during normalization adds to the threat score instead of being quietly cleaned and passed along [19][20]. Successful decoding is not a clean bill of health.
Mail providers have somewhere to fall back to when the words stop matching, including sender reputation, link analysis and header inspection [18]. An agent handed a support ticket has the text and not much else [3].
What to watch
- Whether Microsoft publishes message-level detail showing if any tag payloads in this campaign carried instructions rather than word breaks.
- Whether mail filters and moderation APIs add tag-range stripping as a default, and how they handle the subdivision flag exception.
- Whether tokenizer maintainers document tag-character handling, so "test the tokenizer you ship" becomes a spec line instead of an experiment.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption50
- Hype gap+30
- Incentives60
- Confidence65
Perspective Coverage
3 publishers- Builder
- Builder 50%
- Operator
- Operator 43%
- Investor
- Investor 7%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Microsoft flagged a phishing campaign in which attackers slip invisible Unicode tag characters into email bodies; the characters do not render on screen but change the underlying string that software processes.
- [2]
Security researchers have documented a nearly identical technique targeting LLMs, commonly called ASCII Smuggling, using Unicode tag characters in the U+E0000 to U+E007F range: code points that exist in the character stream but are not displayed by most interfaces.
- [3]
Email providers have ways to spot a suspicious message beyond the words it contains, whereas an AI pipeline may be working with far less information, which matters when agents pull in outside text and use it to decide what to do next.
- [4]
For applications with no reason to accept characters in the U+E0000 to U+E007F range, The New Stack says the simplest approach is to remove them before the text reaches the model, which gets trickier when an application has a legitimate reason to keep them.
- [5]
Where tags must be kept, developers can compare the original text with a tags-removed version and look for changes, and whatever gets cleaned should stay that way through the rest of the pipeline rather than checking one version and sending the untouched original to the LLM.
- [6]
The dev.to writeup says Microsoft's threat intel team flagged spam operators using ASCII smuggling in email campaigns, a technique that until recently mostly showed up in conference talks about jailbreaking chatbots.
- [7]
The dev.to writeup states that the exact mechanics of how spammers are weaponizing the technique were not detailed in the reporting it read.
- [8]
In the campaign tracked by Microsoft Defender for Office 365, attackers were not smuggling hidden instructions into an AI model; they placed tag characters inside high-signal financial phishing words such as "funding", "loan" and "credit" so that filters scanning for those terms would no longer find an exact match.
- [9]
The New Stack's worked example: a human sees "funding" while the underlying text is fun<U+E0020>ding.
- [10]
A hunting signature for ASCII Smuggling fired on roughly 21,000 messages the day before the campaign started, on more than 1.3 million the next day, and the count passed 2.3 million two days after that.
- [11]
Throughout the campaign, recipients saw ordinary-looking offers for business loans and credit lines.
- [12]
Running text through standard Unicode normalization will not necessarily remove the tags: NFC and NFD clean up different representations of the same character but were not designed to strip Unicode tag characters, so those tags can still reach the next step.
- [13]
Stripping every Unicode tag character is not always safe: the subdivision flag emojis for England, Scotland and Wales rely on invisible tag-character sequences to render, and Microsoft's initial hunting signature was broad enough to trip on those flags before the team carved out an explicit exception.
- [14]
What happens to a smuggled tag character depends on the tokenizer: some may ignore it while others split the surrounding text differently, so developers have to test the models they are actually using rather than assume uniform behaviour.
- [15]
The jump from about 21,000 signature hits the day before the campaign to more than 1.3 million the next day is roughly a 62-fold increase.
- [16]
The 2.3 million figure is about 110 times the roughly 21,000 hits recorded the day before the campaign started.
- [17]
Microsoft says attackers are already using the technique at scale to bypass spam filters and ML-based classifiers, and that the same approach could cause problems for AI systems that regularly ingest text from external sources.
- [18]
The dev.to writeup argues standard spam filters and content moderation pipelines are built around visible content (keyword lists, sender reputation, link analysis, header inspection) and none of that touches invisible Unicode ranges by default.
- [19]
The dev.to writeup describes its product Sentinel as stripping invisible characters and resolving the Unicode tag block, along with bidi override characters and homoglyphs, before any pattern matching or semantic scoring happens.
- [20]
In the design the dev.to writeup describes, obfuscation detected during normalization adds to the threat score rather than being silently cleaned up and waved through.
Sources
3 independent publishers whose own reporting we read for this story.
- dev.toASCII Smuggling Just Graduated From AI Attacks to Your Inbox
1 article · September 6, 2026
- ASCII Smuggling Jumps From AI Attacks to Spam, and It Peaked at 2.37 Million Emails a Day - Hardware Busters
hwbusters.com
1 article · September 6, 2026
- thenewstack.ioMicrosoft built a prompt injection detector. Then it caught a phishing campaign instead.
2 articles · September 4, 2026
Topics and entities
Topics
- Unicode normalization
- Phishing
- Prompt injection