Invisible characters in email: ASCII smuggling is now evading phishing filters

A person reads “invoice” or “payment” in an email subject. A simple filter may see a different sequence because extra, invisible Unicode characters sit between the ordinary letters. Nothing changes visually, but a keyword search, rule or regular expression may fail to recognise the lure.

Microsoft observed this technique in a high-volume phishing campaign. An idea previously discussed in research on prompt injection against AI systems was repurposed for a more conventional goal: hiding finance-related keywords from email defences.

What is actually hidden in the text

The campaign used characters in the Unicode Tags block, covering U+E0000–U+E007F. They are invisible in many interfaces but remain part of the text processed by software. An attacker can insert them between the letters of a word that a person recognises immediately.

This is not the familiar trick of substituting lookalike letters from different alphabets. The screen may display precisely the expected word while its digital representation contains extra code points. A rule looking for the literal sequence will then miss it.

The name “ASCII smuggling” is slightly misleading because this technique uses Unicode. The phrase has nevertheless become associated with concealing instructions or content in characters the user cannot see.

The scale that exposed the campaign

Microsoft says detections rose on 9 February 2026 and remained elevated on weekdays for about three months. That repeatable rhythm and the volume of messages helped distinguish a campaign from isolated unusual emails.

It is a useful lesson for defenders: an artefact may be ambiguous in one message and highly meaningful across thousands of similar messages from related senders.

Normalise before you match

Microsoft’s most practical recommendation is to normalise content before it reaches keyword rules, signatures and regular expressions. Here, that means stripping or folding invisible Tags-block characters and other code points that add no visible content.

It is sensible to retain two forms of the message:

• the original for incident analysis and evidence;
• normalised text for detection, indexing and automated analysis.

The same rule should apply before email content is passed to an AI model. If a filter inspects text after one transformation while an assistant or classifier receives another version, the gap between those layers becomes an opportunity for evasion.

An invisible character is not always an attack

Blocking every message containing a character from this range would be a mistake. Microsoft notes that tag sequences have legitimate uses, including the emoji flags for England, Scotland and Wales. An absolute rule would therefore create false positives.

A stronger signal combines several features: invisible characters inside finance-related words, a repeated message template, related sender domains, unusual volume and links pointing to common infrastructure. The artefact is a valuable anomaly, but context gives it meaning.

What an ordinary recipient can do

Users should not be expected to inspect code points in every message. Their task remains straightforward: do not open an invoice or approve a payment merely because its subject sounds urgent. Confirm the request in a known accounting system or through a separate channel with the supposed sender.

If text behaves oddly when copied, email search cannot find a visible word or selection looks unusual, send the message to the security team as an attachment. This preserves its original structure better than a screenshot.

What the source says and what Breachroad recommends

On 3 September 2026, Microsoft described ASCII smuggling used to evade phishing filters. Details about the Unicode Tags block, the campaign timeline, the activity increase and legitimate uses of the characters come from that analysis.

Breachroad recommends testing the entire processing path: the email gateway, DLP tools, search and AI systems. Normalising content in one place does not guarantee that every downstream layer will see the same text.

For the everyday side of the problem, read our guide to recognising phishing. We help organisations connect human behaviour with technical controls through cybersecurity training.