Millions of Phishing Emails Use ASCII Smuggling to Bypass Security Filters
KnowBe4, Monday, September 21st, 2026
Microsoft found a massive phishing campaign hiding financial keywords like 'funding' using invisible Unicode tag characters to evade filters.
Microsoft researchers describe a large-scale phishing campaign using 'ASCII smuggling,' invisible Unicode tag characters, to hide suspicious financial keywords such as 'funding' from automated email filters while the message still reads normally to a human recipient.
The technique, which grew popular over the past year for AI prompt injection attacks, works because the same invisibility that hides instructions from a model also hides keywords from a detector matching literal strings.
Microsoft says a scanner or regex that doesn't account for the interleaved invisible characters won't recognize the keyword, even though it displays correctly to the recipient.