A Unicode-based technique originally used to smuggle hidden instructions into AI systems has now been widely adopted by spammers seeking to dodge email filters, according to Microsoft. Known as ASCII smuggling, the method exploits a block of invisible Unicode "tag" characters that mirror standard ASCII characters but are readable by computers while remaining invisible to human readers. It first drew attention roughly two years ago as a way of concealing malicious prompt-injection instructions from people while still being processed by large language models, and its move into mass spam campaigns shows how techniques developed for attacking AI can quickly be repurposed for older forms of abuse.

Microsoft reported that detections of ASCII smuggling signatures in Microsoft Defender for Office surged from around 21,000 a day to over 1.3 million in early February, reaching 2.5 million within four days, before the wave subsided sharply by mid-May. Spammers insert the invisible characters into trigger words, such as splitting "funding" so filters read "fun" and "ding" while recipients still see the intact word. While similar tricks using zero-width spaces have existed for decades, Microsoft says the greater threat lies in the technique's ability to disrupt machine-learning and natural-language-processing spam classifiers by breaking words into unfamiliar tokens, potentially evading detection unless filters use image-based OCR or are specifically updated to catch it.