ASCII smuggling, a Unicode block that people cannot see, is becoming widespread, from AI attacks to bypassing spam filters. The technique came to prominence about two years ago to conceal prompt injection attacks targeting large language models (LLM). Attackers encode instructions using special Unicode tags instead of normal text; U+E0041 represents the character “A”, while U+E0061 represents “a”. This block of 128 tags can be read by computers but remains almost completely invisible to people.
Microsoft detected a major increase in spam using this method earlier this year. On one day in early February, the ASCII smuggling signatures detected by Microsoft Defender for Office rose from approximately 21,000 per day to more than 1.3 million, reaching 2.5 million within four days. The increase continued for months before dropping sharply in mid-May.
Spammers split words such as “credit” and “term”, which filters look for, or monetary amounts, using invisible characters. For example, while the word “funding” may be interpreted by the filter as “fun” and “ding”, the recipient continues to see the word normally. Zero-width and non-breaking spaces have also been used for similar purposes for decades.
The preference for hidden tags may be driven by the fact that some filters do not recognize them and that they can mislead classifiers based on machine learning and natural language processing. Unless the text is converted into an image and OCR is applied, the attack may go undetected. Microsoft has published recommendations for developers to help filters better recognize ASCII smuggling.
Why it matters
This method widens the gap in email security between the content seen by humans and the content evaluated by software, so it concerns not only users in their inboxes but also the teams developing filtering and classification systems. Words split by invisible characters reveal the limitations of traditional keyword scanning as well as machine learning- and natural language processing-based checks. Because the same technique is also used in prompt injection attacks targeting artificial intelligence systems, the issue extends beyond spam detection to the reliable interpretation of text. The open question is how these markers can be detected consistently without converting the text into an image and applying OCR, and to what extent Microsoft’s recommendations for developers will be implemented across different filters.