ASCII smuggling, a technique previously used to hide malicious AI prompts, is now being leveraged by spammers to avoid detection by email filters. This method involves embedding nearly invisible unicode tags within text, making it difficult for spam detection systems to identify key trigger words in emails. Microsoft reported a significant spike in ASCII smuggling signatures detected in spam from early February to mid-May 2026, with detections rising from 21,000 to 2.5 million daily.
Spammers utilize these tags to obscure words commonly flagged by filters, thereby enhancing their chances of bypassing security measures. Techniques like zero-width spaces had been used before for similar obfuscation, but ASCII smuggling represents a new challenge for spam detection systems relying on machine learning. Microsoft has outlined recommendations for developers to improve filtering techniques to combat this evolving threat.