September 6, 2026, (Inside AI) — A surge in spam emails is exploiting an invisible text trick to slip past AI-powered filters. Microsoft researchers say the technique, called ASCII smuggling, has pushed daily detections from 21,000 to over 1.3 million in a single day.
The campaign inserts hidden Unicode tag characters into email text. These tags are invisible to humans but readable by machines. Spammers use them to break up keywords that filters look for, like "funding" or "credit."
A filter might see "fun" and "ding" instead of "funding." The recipient still sees the full word. This lets phishing emails reach inboxes without raising suspicion.
Microsoft observed the spike on a day in February 2026. Detections rose to 2.5 million within four days before dropping sharply in mid-May. The campaign targeted email platforms at high volume.
The technique first emerged over two years ago in prompt injection attacks on AI agents. Attackers encode malicious instructions into Unicode tags that large language models can read but humans cannot.
Now spammers are repurposing that method for traditional phishing. The mechanism is similar, but the goal is inverted. Instead of hiding commands for AI, they hide keywords from AI filters.
Microsoft explained the core issue in a statement.
"Because tag characters are invisible to humans but exist at the text-processing level, the same property that makes them useful for smuggling instructions into a model also makes them useful for obfuscating keywords before a detector evaluates them." Microsoft
The company added that the intent is inverted but the mechanism is similar, and a user's suspicions are not raised.
Why Invisible Tags Break Modern Spam Defenses
Spam filters search for text patterns common in mass emails. Dollar amounts, "credit," and "term" are typical triggers. ASCII smuggling breaks those patterns by inserting invisible tags inside words.
The tags come from a special Unicode range. For example, U+E0041 represents "A" and U+E0061 represents "a." A block of 128 tags mirrors the ASCII system. But the encoded characters are almost invisible to humans.
This creates a gap between what a human sees and what a machine processes. A filter that relies on text parsing may miss the attack entirely.
Microsoft noted that only visual analysis would catch it.
"Unless a filtering system takes a picture of a message and does OCR extraction over the visual image, it may miss this type of attack." Microsoft
The bigger prize for attackers is not just evading literal string matches. It is defeating the machine learning and natural language processing models that drive modern spam classification.
Email Remains A Prime Phishing Channel
Email is still a major vector for phishing and malware distribution. The stakes are high for both users and security teams. Spam detection is an ongoing challenge even in the AI era.
Microsoft has provided guidance for developers to reprogram email filters in response to ASCII smuggling. The technique shows how AI-era evasion methods are being adapted for older attack types.
Security researchers have also warned about AI agents being used to spam messaging platforms. The same Unicode trick could hide malicious prompts in other channels.
For now, the rapid rise and fall of the campaign suggests a coordinated effort. Spammers tested the technique at scale, then shifted tactics as defenses began to adapt.
