ASCII Smuggling Used to Evade Phishing Filters

SNACK Summary in 3 Lines

Invisible Unicode tags inserted inside high-signal finance terms
Activity jumped from roughly 21,000 to more than 1.3 million messages in one day
More than 99% flagged through layered protections beyond tag-character detection

phishing email that used invisible Unicode tag characters” style=”width:100%;height:auto;max-height:560px;object-fit:contain;border-radius:12px;”>

Image source: Microsoft Security Research — finance-themed phishing email example

Snackgirls react

AIKO — A single unseen code point can split a token without changing the word on screen. I want normalization at the front of the pipeline, before rules or AI process the text.

Nea — An urgent finance offer is where I would deliberately slow down. If the sender is unfamiliar, I’d pause before doing anything the message asks.

Microsoft Security Research has detailed a phishing-evasion technique that changes how software processes a word without changing how that word appears to the recipient. The finance-themed campaign used invisible Unicode tag characters to interfere with basic keyword matching while leaving messages visually intact.

One invisible character can split a keyword

The technique, commonly called ASCII smuggling, uses characters from the U+E0000–U+E007F tag block. Rather than concealing complete instructions, the attackers inserted a single invisible tag character inside high-signal words such as “funding.” A recipient would still see the normal word, but a literal matcher or tokenizer that had not normalized the text could process it as a broken sequence.

Image source: Microsoft Security Research — telemetry showing the February 2026 activity spike

A weekday-heavy surge across finance-themed domains

Microsoft telemetry for its tuned signature rose from roughly 21,000 messages on February 8 to more than 1.3 million on February 9, 2026. The activity clustered around about 150 finance-themed sender domains, with weekday totals ranging from 1 million to 2.37 million messages and reaching their peak on February 26. Weekend activity fell close to zero.

High-volume use of this specific technique continued for roughly three months, dropped sharply after May 15, and remained at lower levels through mid-June. That timeline covers the technique observed in Microsoft telemetry, not the full lifetime of the broader campaign.

Image source: Microsoft Security Research — three months of weekday-heavy campaign activity

Detection required more than a simple Unicode rule

Blocking every tag-block character would also catch legitimate subdivision flag emoji sequences for England, Scotland, and Wales, so Microsoft adjusted its hunt to exclude those cases. The company says layered protections flagged more than 99% of the campaign messages through signals such as sender, IP, URL and domain reputation, spam and phishing classification, impersonation detection, and authentication checks—not tag-character detection alone.

Image source: Microsoft Security Research — second finance-themed phishing email example

Pause when an unexpected message creates urgency

For mail-defense pipelines, Microsoft recommends stripping or normalizing invisible characters before keyword rules, signatures, regular expressions, or AI-ingestion systems process the text.

Recipients should pause when an unexpected finance message demands urgent action. Examine messages from first-time, infrequent, unknown, or externally marked senders carefully before taking the requested action; the hidden character itself may not be visible on screen.

Sources and checked date: Microsoft Security Research · Microsoft Support · September 5, 2026