email security2 articles
Phishers Borrowed a Trick From AI Attackers — And It Nearly Worked
Microsoft discovered a large-scale phishing campaign that repurposed **ASCII smuggling** — a technique typically used to hide malicious instructions from AI models — to evade traditional email spam filters. Attackers inserted invisible Unicode tag characters within common financial keywords (e.g., "fun⟨U+E0020⟩ding") to break up words and defeat keyword-matching and content filters, with the campaign peaking at over 2.37 million messages in late February before gradually declining by mid-June. Microsoft recommends that defenders strip or normalise invisible Unicode characters before applying keyword or regex filtering, and flag behavioural patterns such as high-volume, finance-themed emails operating on a strict weekday schedule as strong indicators of such campaigns.
An Executive's Inbox Was Silently Plundered for Five Months. Here's What That Tells Us About AI-Assisted Attacks
A stock exchange executive had their Outlook mailbox compromised for five months without anyone noticing. Five months.