Free tools Windows power users keep installed
One-click scans. No signup required.
ASCII smuggling is the use of invisible Unicode characters to hide or alter text that looks ordinary to a person. In a phishing campaign analyzed by Microsoft in 2026, attackers inserted an invisible tag character inside finance-related lure words—so a word such as “funding” could be transmitted as fun⟨U+E0020⟩ding. That can frustrate a filter relying on an exact text match, but it does not automatically bypass email security, and the campaign’s use differed from hidden instructions designed to manipulate an AI model.
What is ASCII smuggling?
ASCII smuggling uses invisible or non-rendering Unicode characters to carry or alter content inside text that appears normal in common fonts and interfaces. The term is associated with the Unicode Tags block, U+E0000–U+E007F, whose tag characters can correspond to printable ASCII characters. A recipient may see an ordinary word while the underlying text contains additional code points.
As an Amazon Associate I earn from qualifying purchases.
The effect depends on what happens to the text downstream. A mail filter that searches for a contiguous string may miss a word split by an invisible character if it checks the unnormalized text. A machine-learning classifier may also tokenize the altered text differently. Neither outcome is guaranteed: results depend on each system’s normalization, parsing, and detection pipeline.
How the phishing use differs from hidden AI instructions
In the phishing campaign, characters split lure words
Microsoft’s 2026 example placed U+E0020, the invisible TAG SPACE, between “fun” and “ding.” The visible word could still look like “funding,” while the underlying sequence was fun⟨U+E0020⟩ding. In the messages Microsoft sampled, tags acted as separators inside lure words; researchers did not find a hidden ASCII message encoded in the tag block.
#1 Best Overall
In prompt-injection examples, hidden text may carry instructions
AI prompt-injection examples use invisible text for a different purpose: a page, document, or email may contain instructions that a person does not see but that remain in text supplied to an AI model. Whether the model acts on them depends on the system’s design, access, and safeguards. Microsoft’s overview of indirect prompt injection describes why detection alone is not enough and why limiting permissions and potential impact matters (Microsoft Security Response Center, July 2025).
The shared issue is a gap between what a person perceives and what software processes. The intent and risk, however, are not interchangeable: splitting a phishing keyword to frustrate matching is not the same as embedding instructions intended to influence an AI.
What Microsoft observed in the 2026 campaign
Microsoft Security Research, Noam Kochavi, and Sarah Wolstencroft published their analysis on September 3, 2026. Microsoft said its technique-specific signature rose sharply on February 9, 2026, and its Defender for Office 365 telemetry recorded more than 2.3 million messages on February 11. The high-volume phase dropped sharply after May 15, with lower residual activity into mid-June. These figures describe Microsoft’s telemetry for a particular signature and activity cluster, not all phishing or all ASCII-smuggling attacks (Microsoft Security Research).
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →The lures involved business funding, loans, and credit lines. Microsoft linked the tag-character activity to a broader SBA-themed phishing campaign and said the observed phase used infrastructure associated with legitimate email-marketing platform ActiveCampaign. The broader campaign predated the tag-character technique and continued after that specific behavior declined.
Rank #3
Microsoft reported that roughly 96% of the signature volume was associated with the finance-themed pattern. In Microsoft Defender for Office 365 telemetry, more than 99% of the messages were flagged by other protection layers—including sender, IP, URL, and domain reputation; machine-learning classification; brand-impersonation detection; and authentication checks. Those are product- and campaign-specific observations, not universal performance benchmarks for email providers.
Why invisible characters are a broader email-security issue
ASCII smuggling is a newer label for an underlying evasion idea: insert characters that change a machine’s text without visibly changing the word a recipient reads. Microsoft documented earlier phishing use of soft hyphens (U+00AD) and word joiners (U+2060) to fracture email keywords in its 2021 review of techniques that hide in plain sight (Microsoft Threat Intelligence).
The deeper trust problem is that different components may operate on different representations of the same message: a recipient sees rendered text, while a filter or AI application may receive raw characters, normalized text, extracted content, or tokens. A control that checks only one representation can miss activity visible in another. This does not make every invisible character malicious; Unicode has legitimate uses, and systems should distinguish expected text from suspicious anomalies.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallHow defenders can reduce the risk
Normalize before matching
Apply Unicode normalization or remove relevant invisible characters from email subjects and bodies before keyword, regular-expression, or signature checks. Microsoft summarized the principle as: “The core defensive principle is simple: normalize before you match.” The practical goal is to ensure that a visually ordinary word is checked in a representation that does not let hidden separators break the match.
Best Value
Flag unusual characters with exceptions
Tag-block characters can be a useful anomaly signal, but a rule that rejects every character in U+E0000–U+E007F can create false positives. Microsoft notes legitimate tag sequences used in England, Scotland, and Wales subdivision flag emojis. Detection should account for valid uses rather than treating the entire block as proof of an attack.
Layer content checks with campaign signals
Character-level checks work best alongside sender and infrastructure reputation, authentication, URLs, domain patterns, and behavioral evidence. Microsoft’s telemetry illustrates why: most of the messages it studied were caught by protections other than direct tag-character detection. Security teams should test the behavior of their own mail-processing pipeline, because implementations differ.
Apply the same care to AI inputs
If an AI application ingests email or other untrusted text, normalize or inspect that content before model ingestion as appropriate to the system. Also limit the model’s permissions and the consequences of successful prompt injection. Hidden-text detection may help, but it should sit within defense in depth rather than serve as the only safeguard.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
