MICROSOFT'S research highlights a new high-volume phishing campaign that uses invisible Unicode tag characters, a technique known as 'ASCII Smuggling', which was previously associated with AI prompt injection. This campaign started on February 9, 2026, drastically increasing phishing email volume by obfuscating financial lure words to evade detection. ASCII smuggling entails inserting invisible tag characters (U+E0000 to U+E007F) into recognizable keywords, such as 'funding', to disrupt standard email filters.
The attack showcases a novel twist on traditional phishing tactics, as the same methods used in AI security are repurposed for phishing evasion. Microsoft Defender for Office 365 monitors and detects these tactics, suggesting that defenders should normalize content before applying signature matching and treat the use of Unicode tag characters as a strong anomaly signal.