Finance · Euroglobal New
REG AD security Phishers find a new use for invisible Unicode tag characters Fraudsters have found a new use for ASCII smuggling, typically used to hide malicious prompts intended for AI models, in an old-school attack method: email phishing. Microsoft uncovered a massive phishing campaign using invisible Unicode tag characters that peaked at more than 2.37 million messages in late February, remained elevated during weekdays over the next three months, and gradually declined by mid-June. “As AI-era attack methods become better understood, threat actors may adapt them for use in more traditional threats such as phishing and spam,” Redmond’s researchers Noam Kochavi and Sarah Wolstencroft said in a Thursday blog. “This case illustrates how techniques that emerge in AI security research can quickly cross over into established attack ecosystems, reinforcing the need for defenders to view emerging threats through a cross-domain lens.”
REG AD ASCII smuggling involves using invisible or non-rendering Unicode characters to hide content inside text that appears normal to humans. This makes it a popular technique for indirect prompt injection attacks, where an attacker hides instructions for an AI assistant in invisible Unicode characters embedded in a webpage or document. A human cannot see them, but a model decodes them, potentially executing unauthorized actions or leaking data.
Instead of using ASCII smuggling for prompt injection, Microsoft’s security team spotted attackers using invisible Unicode tag spaces to split financial-lure words in phishing emails to evade keyword matching and filters. For example, instead of writing “funding,” attackers wrote “fun⟨U+E0020⟩ding.” The researchers found no AI-related instructions in these emails but confirmed the Unicode tag characters were inserted to split financial keywords.
Microsoft first detected this signature in early February, flagging about 21,000 messages on February 8, which then surged to over 1.3 million the next day. Most emails came from about 150 finance-themed sender domains, continuing for three months before sharply declining after May 15, with occasional smaller spikes through mid-June. The campaign’s notable traits included weekday spikes and weekend silence, with a gradual decline after the initial surge.
The researchers highlighted two key characteristics: weekday volume spikes and a structured on/off schedule. They advised defenders to normalize and tokenize pipelines to handle tag characters consistently, ensuring keyword and regex logic doesn’t fail when Unicode characters splice words. This also helps protect AI assistants against ASCII-smuggling attacks. Behavioral indicators, such as bulk volume from disposable finance domains, were noted as high-confidence campaign signals.
Source: The Register
