Spam fighters face new evasion tactic as attackers weaponize invisible text trick

A once-niche hacking method designed to fool artificial intelligence systems has crossed over into mainstream spam operations. The tactic, known as ASCII smuggling, exploits invisible Unicode characters to hide harmful content from both human readers and automated defenses.

How the trick works#

The technique hinges on a set of 128 special Unicode tags that render nearly identically to standard ASCII characters—but with a crucial difference. While these tags appear as normal text to computers processing the message, they remain virtually invisible to the human eye. Characters like U+E0041 (standing in for "A") and U+E0061 (representing "a") exemplify this dual nature.

When embedded in malicious content, these invisible markers allow attackers to:

• Hide damaging instructions that LLMs can still interpret
• Obscure keywords that trigger spam detection systems
• Evade human scrutiny since recipients see no suspicious text

Microsoft provides more technical detail on the mechanism and its security implications.

From AI attacks to email spam#

The technique gained prominence two years ago in discussions about prompt injection attacks — where adversaries inject hidden instructions into content fed to language models. Now spammers have recognized its value for a different purpose: bypassing the filter systems that email platforms use to identify unwanted bulk messages.

Starting in early February, Microsoft Defender for Office 365 registered a dramatic surge. Daily detections jumped from approximately 21,000 to over 1.3 million in a single day, then climbed to 2.5 million within four days. This spike persisted throughout the spring before tapering off sharply in mid-May.

Why defenders should be concerned#

Microsoft security researchers note that the underlying mechanism works identically whether the goal is concealing AI instructions or evading email filters. "The intent is inverted, but the mechanism is similar, and a user's suspicions are not raised," the company explained. This convergence highlights how security vulnerabilities in one domain can quickly migrate to others as attackers adapt their tactics to new targets.