ASCII Smuggling Repurposed for Phishing Evasion

Microsoft researchers have identified a shift in the usage of Unicode tag characters (U+E0000 to U+E007F), previously known primarily for AI prompt injection and cross-prompt injection (XPIA) research. Threat actors are now utilizing these invisible tag characters to obfuscate financial lures in phishing emails. By embedding these non-rendering characters within malicious keywords, attackers successfully split terms - such as 'funding' - into fragmented strings that are invisible to human readers but bypass traditional text-based email security scanners.

This activity was detected using signatures originally designed to hunt for hidden prompt injection content in email environments. Telemetry indicates a significant rise in this evasion technique starting February 9, 2026, with elevated activity observed over a three-month period. While the technique successfully evades keyword-based filtering, Microsoft notes that layered security defenses, rather than singular Unicode-specific signals, remain the most effective mitigation strategy against this phishing methodology.

Impact

The use of ASCII smuggling enables attackers to bypass conventional email security filters that rely on string matching to identify phishing lures. By successfully embedding financial keywords that security scanners cannot parse, threat actors increase the likelihood that malicious emails reach end-user inboxes. This obfuscation technique poses a systemic risk to organizations relying on static keyword-based email filtering to block credential theft and social engineering campaigns.

Recommendation

• Implement hunting logic to identify the presence of Unicode tag characters (U+E0000-U+E007F) within inbound email content to detect potential keyword obfuscation.
• Tune security detection logic to account for legitimate usage of tag characters in specific regional subdivision flag emojis (England, Scotland, Wales) to minimize false positives.
• Deploy layered email security defenses that do not rely exclusively on string-based keyword matching, as obfuscation techniques like ASCII smuggling render static filters ineffective.
• Monitor Microsoft Defender for Office 365 telemetry for patterns involving non-rendering characters in email bodies, as this may indicate an attempt to bypass traditional security filters.