Microsoft Uncovers "ASCII Smuggling" Phishing Campaign Targeting AI Email Filters

A trick born in AI security research just showed up somewhere far more mundane: spam folders. Microsoft security researchers disclosed on September 3 that they'd found a high-volume phishing campaign using ASCII smuggling, a technique typically associated with hiding malicious instructions from AI models, repurposed instead to dodge old-fashioned keyword filters in Microsoft Defender for Office 365.

Researchers Noam Kochavi and Sarah Wolstencroft expected to find hidden AI instructions when a detection signature started spiking. Instead, they found something almost anticlimactic: attackers using invisible characters to simply break up financial trigger words like "funding" so filters couldn't recognize them, all while the word still looked completely normal to a human recipient. A few numbers show just how large the campaign got:

• Detection hits jumped from roughly 21,000 messages to over 1.3 million in a single day on February 9
• Volume peaked at 2.37 million messages on weekdays and stayed elevated for roughly three months
• The campaign traced back to a previously documented SBA-themed phishing operation that predated the Unicode trick entirely

Microsoft was careful to note the irony isn't lost on them: the same invisible characters that can smuggle instructions past AI assistants can also smuggle words past AI-based spam filters, since both rely on how the underlying text gets parsed.

According to The Register's coverage of the findings, the campaign's volume began tapering off by mid-May, though Microsoft's core recommendation — normalizing invisible Unicode characters before any keyword or signature check runs — applies well beyond this one operation, and likely to any organization running AI-assisted filtering on inbound mail.