ASCII smuggling isn't just an AI security risk

Fraudsters have turned to ASCII smuggling, a technique previously used in AI security, for a new form of email phishing. Microsoft uncovered a massive phishing campaign, peaking at over 2.37 million messages in late February, which remained active during weekday hours over the following three months before gradually declining by mid-June.

Researchers from Microsoft, Noam Kochavi and Sarah Wolstencroft, stated that AI-era attack methods may be adapted for use in more traditional threats such as phishing and spam. ASCII smuggling involves using invisible or non-rendering Unicode characters to conceal content in text that appears normal to humans, making it a popular method for indirect prompt injection attacks.

In these attacks, an attacker hides instructions for an AI assistant in invisible Unicode characters within a webpage or document. Instead of using ASCII smuggling for prompt injection, Microsoft's researchers observed attackers using invisible Unicode tag characters to split financial keywords in phishing emails, aiming to bypass keyword matching and other content filters.

These invisible characters, such as "fun⟨U+E0020⟩ding," can evade detection systems. Microsoft first detected the ASCII-smuggling signature in early February, flagging about 21,000 messages on February 8, which increased to over 1.3 million the next day. The emails primarily originated from around 150 finance-themed sender domains and continued for the next three months, declining sharply after May 15 but persisting with occasional smaller spikes through mid-June.

The researchers noted two key characteristics of the campaign: sending a high volume of emails on weekdays and going silent over the weekends. Additionally, the campaign showed a long, gradual decline after an intense first phase. To protect against Unicode tag blocks in phishing emails, Microsoft suggests verifying that normalization and tokenization pipelines handle tag characters consistently.

This approach can also help mitigate the threat of ASCII-smuggling against AI assistants that process email content. Microsoft further advises scanning for behavioral indicators, such as a sudden spike in tag-block characters concentrated on finance-themed senders with a weekly on-and-off schedule, as a high-confidence campaign indicator.