Microsoft discovered a large-scale phishing campaign that repurposed **ASCII smuggling** — a technique typically used to hide malicious instructions from AI models — to evade traditional email spam filters. Attackers inserted invisible Unicode tag characters within common financial keywords (e.g., "fun⟨U+E0020⟩ding") to break up words and defeat keyword-matching and content filters, with the campaign peaking at over 2.37 million messages in late February before gradually declining by mid-June. Microsoft recommends that defenders strip or normalise invisible Unicode characters before applying keyword or regex filtering, and flag behavioural patterns such as high-volume, finance-themed emails operating on a strict weekday schedule as strong indicators of such campaigns.
