Once popular for attacking AI, ASCII smuggling is embraced by spammers
A Unicode-based technique originally used to smuggle hidden instructions into AI systems has now been widely adopted by spammers seeking to dodge email filters, according to Microsoft. Known as ASCII smuggling, the method exploits a block of invisible Unicode "tag" characters that mirror standard ASCII characters but are readable by computers while remaining invisible to human readers. It first drew attention roughly two years ago as a way of concealing malicious prompt-injection instructions from people while still being processed by large language models, and its move into mass spam campaigns shows how techniques developed for attacking AI can quickly be repurposed for older forms of abuse.
Microsoft reported that detections of ASCII smuggling signatures in Microsoft Defender for Office surged from around 21,000 a day to over 1.3 million in early February, reaching 2.5 million within four days, before the wave subsided sharply by mid-May. Spammers insert the invisible characters into trigger words, such as splitting "funding" so filters read "fun" and "ding" while recipients still see the intact word. While similar tricks using zero-width spaces have existed for decades, Microsoft says the greater threat lies in the technique's ability to disrupt machine-learning and natural-language-processing spam classifiers by breaking words into unfamiliar tokens, potentially evading detection unless filters use image-based OCR or are specifically updated to catch it.
In short
- Spammers now use invisible Unicode "tags" once reserved for AI attacks
- Microsoft saw detections spike from 21,000 to 2.5 million daily
- Hidden characters disrupt spam filters, especially ML/NLP-based classifiers
Explained simply
Unicode is a standard that lets computers represent text from many languages and symbol sets. Some Unicode characters are invisible to people but can still be processed by software, including AI systems and email filters.
ASCII smuggling uses invisible characters that correspond to ordinary letters. It first drew attention as a way to hide instructions from people while leaving them readable to AI; similar tricks, such as inserting zero-width spaces, have also been used to interfere with spam filters.
Email providers use filters to spot unwanted messages, including systems that analyse words and patterns. When invisible characters split a word into unfamiliar pieces, those systems may have trouble recognising it, while the message still looks normal to its recipient.