4 min readNew DelhiUpdated: Sep 6, 2026 11:28 AM IST
As AI systems become increasingly capable, AI-powered email spam filters have evolved alongside them to get better at keeping unwanted messages out of a user’s inbox. However, spammers continue to find new ways to bypass these defences using sophisticated techniques.
One such technique broadly known as ‘ASCII smuggling’ is being widely adopted by spammers to evade filters on email platforms designed to catch unwanted messages used in mass campaigns.
Microsoft researchers on Thursday, September 3, said that they observed a high-volume phishing campaign involving ASCII smuggling, where spammers inserted invisible Unicode tag characters to prevent email filters from parsing them. The same technique has been used in the past to hide malicious prompts in attacks on AI agents, otherwise known as prompt injection attacks.
Since the start of the year, there has been a surge in the number of spam messages delivered to email inboxes with the help of ASCII smuggling, according to Microsoft. The researchers found that on one day in February 2026, the number of ASCII smuggling signatures detected by Microsoft Defender for Office spiked from roughly 21,000 per day to more than 1.3 million.
This figure further rose to 2.5 million in the next four days before falling off sharply in mid-May.
Microsoft’s findings highlight how AI-era evasion techniques are being repurposed to improve traditional phishing tactics. The stakes are high as email is still a major vector for phishing and other scams involving malware distribution. It further shows that spam detection and filtering is an ongoing cybersecurity challenge even in the modern AI era.
“Because tag characters are invisible to humans but exist at the text-processing level, the same property that makes them useful for smuggling instructions into a model also makes them useful for obfuscating keywords before a detector evaluates them,” Microsoft said.
Story continues below this ad
“The intent is inverted, but the mechanism is similar, and a user’s suspicions are not raised,” it added. The Windows-maker provided tips for developers to re-programme email filters in response to ASCII smuggling.
What is ASCII smuggling?
ASCII smuggling first drew attention over two years ago as a way of making prompt injection attacks against AI agents more stealthy.
Since large language models (LLMs) powering AI agents do not process ordinary text and generally convert them into tokens, embedding malicious instructions in emails or other untrusted content may not always work.
Instead, hackers render text into a special range of Unicode tags. For example, the tag point U+E0041 represents ‘A’ and U+E0061 mirrors ‘a’. A block of 128 tags is arranged to resemble the ASCII (American Standard Code for Information Interchange) system. However, there is one key difference: the encoded characters are only readable by computers and almost completely invisible to humans.
Story continues below this ad
By converting malicious prompts into these Unicode tags, spammers are able to feed it to LLMs without users knowing.
How does it help evade spam filters?
Spam filters essentially work by searching for text commonly found in mass emails such as dollar amounts and the words ‘credit’ and ‘term’.
In an attempt to evade these filters, spammers are inserting invisible Unicode tags in the middle of a plaintext word such as ‘funding’ so that the spam filter reads the words as ‘fun’ and ‘ding’ instead. Meanwhile, the recipient of the email still sees the whole word ‘funding’.
“The bigger prize for the attacker, though, is not preventing the literal string matches; it is the ML- and NLP-based models that increasingly drive modern spam and phishing classification,” Microsoft said.
Story continues below this ad
“Unless a filtering system takes a picture of a message and does OCR extraction over the visual image, it may miss this type of attack,” it added.
