Spammers Hijack AI Evasion Tactics to Bypass Email Filters

Key points

• ASCII smuggling uses the Unicode Tags block (U+E0000 to U+E007F), which mirrors ASCII characters but is invisible to human interfaces. While initially used to inject prompts into LLMs, spammers now use it to obfuscate keywords.
• Microsoft Defender for Office 365 telemetry showed a sharp increase in detections starting February 9, 2026. Daily hits jumped from 21,000 to over 1.3 million within days, peaking at 2.37 million on February 26.
• The campaign targeted finance-themed lures, such as business loans and credit lines. Attackers inserted invisible characters into words like 'funding' to break tokenization in ML-based spam filters, causing detectors to see fragmented or unknown sub-tokens.
• The high-volume phase lasted approximately three months, following a strict weekly cadence with near-zero activity on weekends. The campaign utilized roughly 150 disposable sender domains built from a small vocabulary of financial terms.
• Microsoft noted that the technique exploits a gap in modern filtering systems that rely on ML and NLP. While traditional regex filters might fail, the primary risk is to AI-driven classifiers that process text tokens rather than visual images.

Background

ASCII smuggling gained prominence in 2025 as a method for AI prompt injection, where hidden instructions are embedded in content for LLMs to read but humans cannot see. This technique was previously distinct from traditional spam evasion methods, which typically used zero-width spaces or non-breaking spaces. The current shift represents a convergence of AI security research and traditional phishing tactics, highlighting how evasion techniques developed for one domain can be repurposed for another.

How outlets are covering it

Ars Technica and The Hacker News emphasize the novelty of the character choice and the massive scale of the campaign, noting that while invisible character insertion is not new, the use of the Unicode Tags block at this volume is unprecedented. Microsoft provides the technical depth, explaining how the technique disrupts tokenization in ML models and detailing the specific telemetry spikes. The Hacker News also highlights the connection to a broader SBA-themed phishing campaign documented by Fortra in 2025, suggesting this is an evolution of an existing threat. DevPro Journal focuses on the 'blind spot' in AI email security, framing the issue as a failure of modern detection pipelines to handle specific Unicode ranges.

Why it matters

This development signals a blurring of lines between AI security and traditional cybersecurity. As organizations deploy ML-based email filters to combat phishing, attackers are leveraging AI-specific evasion techniques to bypass these defenses. The reliance on invisible Unicode characters creates a significant risk for automated classification systems, potentially allowing high-volume phishing campaigns to reach inboxes undetected. It underscores the need for defenders to update normalization and tokenization pipelines to handle deprecated Unicode blocks that were previously considered benign.

What to watch

Microsoft has provided guidance for developers to improve filter detection by accounting for ASCII smuggling. ActiveCampaign, the platform used to relay the emails, stated that its moderation systems treat heavy use of invisible Unicode as a suspicious signal. Defenders are advised to verify that their normalization steps handle tag characters consistently to prevent such evasion. The campaign's decline after May 2026 suggests a temporary shift in tactics, but the technique remains a viable vector for future attacks.