Phishers Borrowed a Trick From AI Attackers — And It Nearly Worked

ASCII smuggling has jumped ecosystems. A technique originally developed to slip malicious instructions past AI assistants has turned up in a large-scale email phishing campaign, and the crossover says something uncomfortable about how fast attack methods travel.

Microsoft's threat researchers spotted the campaign in early February. It peaked at over 2.37 million messages in a single day in late February, ran hot on weekdays for roughly three months, then faded by mid-June. Not a small operation.

The trick itself is straightforward once you know it. Unicode's tag block contains invisible, non-rendering characters — things that appear as nothing in your email client but exist in the raw text. Attackers inserted these invisible characters inside common financial keywords to break them apart at the byte level. So instead of writing "funding," you'd write "fun" then an invisible Unicode tag space then "ding." Humans see nothing unusual. Keyword filters see gibberish.

ASCII smuggling originally made its name in AI security research, where the same invisible characters can be used to hide prompt injection instructions inside documents or webpages. An AI assistant reads the page, encounters the hidden text, and potentially follows whatever instructions were smuggled in. The human never sees a thing.

This campaign used none of that. Microsoft researchers Noam Kochavi and Sarah Wolstencroft noted with some surprise that when they examined flagged messages, there were no hidden AI instructions at all. The invisible characters were purely there to defeat literal string matching — old-school signature-based filters that check whether the word "funding" appears in an email.

The campaign ran from around 150 finance-themed disposable sender domains, with a very deliberate Monday-to-Friday schedule. Weekday volumes ranged between one and 2.37 million messages, then went completely silent at weekends. That kind of operational discipline is itself a detection signal, and Microsoft flags it as such.

Defending against this isn't especially complicated, but it does require getting the pipeline right. Before any content hits keyword matching, regex logic, or signature checks, invisible and non-rendering Unicode code points need to be stripped or normalised. If you're evaluating text for phishing indicators without doing that first, you're working with data the attacker has already tampered with.

The same normalisation step also helps reduce ASCII-smuggling risks for AI systems that ingest email content — so it's worth doing once and applying everywhere.

The broader point Microsoft's team is making is worth sitting with. Techniques that emerge from AI security research don't stay there. Once a method for evading detection is documented and understood, it gets adapted. Defenders who treat AI security threats and traditional phishing as separate domains are going to keep getting caught out.