ASCII smuggling isn't just an AI security risk

Microsoft has uncovered a significant phishing campaign utilizing ASCII smuggling, a technique typically employed to conceal malicious prompts for AI models, in email phishing. The attack peaked at over 2.37 million messages in late February, remaining active throughout weekdays for three months before gradually declining by mid-June.

Microsoft's security researchers, Noam Kochavi and Sarah Wolstencroft, noted that "as AI-era attack methods become better understood, threat actors may adapt them for use in more traditional threats such as phishing and spam."

ASCII smuggling involves encoding content within text using invisible or non-rendering Unicode characters, making it popular for indirect prompt injection attacks. In this case, attackers used invisible Unicode tag spaces to split financial-related words in phishing emails, attempting to evade keyword matching and content filters.

For instance, instead of writing "funding," the attackers wrote "fun⟨U+E0020⟩ding." However, unlike prompting AI, the attackers did not insert instructions for an AI assistant but instead used invisible tag characters to split common financial keywords, causing the emails to fail literal signature or keyword matches.

The campaign, first detected in early February, began with around 21,000 flagged messages on February 8, which skyrocketed to over 1.3 million the next day. Most emails originated from approximately 150 finance-themed sender domains. The emails continued for three months, with a sharp decline after May 15 but occasional smaller spikes until mid-June.

Researchers noted two notable characteristics: the bulk volume of emails sent on weekdays and a lack of activity over weekends. The campaign showed a gradual decline after an intense first phase, with weekday volumes dropping to roughly 80 percent less by late March and a significant reduction after May 15, continuing with lower activity through mid-June.

To protect against Unicode tag blocks in phishing emails, Microsoft suggests verifying that normalization and tokenization pipelines consistently handle tag characters. This includes stripping or folding invisible and non-rendering Unicode code points before any evaluation by keyword, signature, or regex logic. Additionally, Microsoft advises scanning for behavioral indicators: a sudden spike of tag-block characters concentrated on finance-themed senders, with a distinctive shape of bulk volume from churning, finance-themed disposable domains, and a strict weekday-on/weekend-off schedule, should be considered a high-confidence campaign indicator.