Spammers Adopt ASCII Smuggling to Evade Email Filters

Invisible characters bypass spam detection

Spammers have embraced a sophisticated evasion technique originally developed to attack AI systems, using invisible Unicode characters to slip past email filters that would normally flag their messages.

The method, known as ASCII smuggling, exploits a block of 128 Unicode tags that mirror standard ASCII characters but remain invisible to human readers. While computers can process these hidden characters, people viewing the text see nothing unusual. A spammer might embed invisible tags within the word "funding," causing filters to read fragmented text like "fun" and "ding" instead of recognizing the complete trigger word.

Microsoft Defender for Office detected a dramatic surge in this activity starting in early February 2026, according to details first reported by Ars Technica. Daily signature detections jumped from roughly 21,000 to more than 1.3 million within 24 hours. Within four days, that number reached 2.5 million and remained elevated for months before dropping sharply in mid-May.

From AI attacks to mass email campaigns

ASCII smuggling first gained attention two years ago as a method for concealing prompt injection attacks against large language models. Attackers embedded malicious instructions in emails or other content using Unicode tags—for instance, U+E0041 represents "A" and U+E0061 represents "a." LLMs would process these hidden instructions while human reviewers remained unaware of their presence.

Spammers now apply the same principle in reverse. Rather than hiding instructions for AI systems, they obscure keywords that spam filters search for, such as dollar amounts or terms like "credit" and "term" that commonly appear in unwanted financial solicitations.

Why it matters

This technique poses a particular challenge for modern email security systems that rely on machine learning and natural language processing. Traditional obfuscation methods like zero-width spaces have existed for decades, but ASCII smuggling specifically undermines ML-based classifiers. When a tokenizer encounters invisible Unicode tags embedded in text, it may split familiar words into unfamiliar fragments or generate rare tokens that don't match known spam patterns. Unless filtering systems capture visual images of messages and perform optical character recognition, they may miss these attacks entirely. The spike in detections suggests spammers found a temporary advantage before security teams adapted their defenses.

Detection and defense

Microsoft noted that the same properties making these Unicode tags useful for smuggling AI instructions also make them effective for keyword obfuscation. The company has published guidance for developers on programming filters to better detect ASCII smuggling in spam messages.

The technique exploits how email classifiers process text for efficiency. Rather than analyzing whole words exactly as humans see them, these systems often split text into tokens or sub-word pieces. A clean term like "funding" might register as a familiar token sequence, but inserting an invisible U+E0020 character disrupts that recognition, potentially causing the system to miss the spam indicator.

These details were first reported by Dan Goodin at Ars Technica.