Unicode tag smuggling jumps from AI prompt injection to phishing
The same invisible characters that hide instructions from AI models are now being used to split keywords so email filters can't read them, and Microsoft saw the spike in February.
TL;DR
Microsoft researchers have documented a phishing campaign that repurposes "ASCII smuggling" (invisible Unicode tag characters from the U+E0000) U+E007F range, to split financial-lure words like "funding" so email filters can't parse them. The technique was popularized in AI prompt-injection research, where attackers hide instructions from humans while exposing them to language models. Microsoft Defender for Office 365 telemetry shows hits on a hunting signature for this pattern jumped sharply on February 9, 2026, and stayed elevated on weekdays for roughly three months. Most flagged messages were caught by layered defenses, not a single Unicode-specific signal.
The finding came out of Microsoft Defender for Office 365's prompt-injection protection work. The team had built hunting logic to catch email-borne cross-prompt injection and prompt obfuscation, content that looks benign to a human but carries hidden instructions for an AI system that ingests the raw message. The same hunt that targeted AI prompt-injection risk became the starting point for spotting this phishing campaign.
The mechanism is the same in both domains. The Unicode Tags block (U+E0000 to U+E007F) contains a shadow copy of printable ASCII (U+E0041 mirrors "A," U+E0061 mirrors "a") but most fonts and user interfaces don't render these code points. A string can carry a message invisible to a person yet readable by any software that processes the raw text. In prompt injection, that gap is used to feed instructions to a language model. In phishing, the attacker uses it to break up keywords so that a detector scans fragments rather than the full word, while the rendered text still looks like a coherent lure to the recipient.
Microsoft's hunting signature looks for messages carrying characters from the Unicode tags block. The broad signature needs enough Unicode context to avoid false positives, but it proved effective at surfacing the campaign. The researchers note that the majority of flagged messages were caught by layered protections in Defender for Office 365 rather than reliance on a single Unicode-specific signal, a reminder that defense-in-depth, not a single detection rule, caught the bulk of this activity.
The crossover matters because it's a clean example of AI-era evasion techniques migrating into traditional phishing operations. The technique was in the prompt-injection literature throughout 2025, appearing in red-teaming write-ups, conference talks, and tooling. Now it's in live phishing campaigns. The property that makes tag characters useful for one attack (they're invisible to humans but present at the text-processing level) makes them useful for the other, and the user never sees anything suspicious.
Published ·Deep Fathom