A surge in spam campaigns is exploiting ASCII smuggling, a technique once used to hide malicious AI prompts, now repurposed to slip past advanced email filters by embedding invisible Unicode tags within key words.
Millions of spam emails have recently slipped through the cracks of supposedly advanced email filters, not by brute force but by exploiting a digital sleight of hand known as ASCII smuggling. In a matter of days this February, Microsoft Defender for Office saw daily detections of this tactic skyrocket from 21,000 to over 2.5 million, overwhelming systems designed to keep inboxes clean.
What makes ASCII smuggling so effective is its use of a block of Unicode tags that mimic the American Standard Code for Information Interchange (ASCII) almost perfectly-except these characters are invisible to the human eye. While a person reading an email sees nothing unusual, computers processing the message encounter hidden instructions or altered keywords, making it nearly impossible for traditional filters to catch the trick.
Dal prompt injection allo spam di massa
Originally, ASCII smuggling was a niche tool for attackers targeting large language models (LLMs) with prompt injections. By encoding malicious prompts in invisible Unicode tags-such as U+E0041 for "A" or U+E0061 for "a"-attackers could sneak instructions past human reviewers and directly into AI systems. Now, spammers have seized on the same method, not to manipulate AI, but to evade the increasingly sophisticated machine learning and natural language processing models that power modern spam filters.
Microsoft's analysis reveals that spammers are embedding these invisible tags within words that typically trigger spam detection, like "credit," "funding," or "term." For example, inserting a hidden Unicode character into "funding" can split the word into "fun" and "ding" for the filter, while the recipient still sees the original word intact. This undermines both simple keyword matching and more advanced tokenization strategies used by AI-based classifiers.
La risposta dei filtri e le nuove sfide
While the use of zero-width and non-breaking spaces to obfuscate text is nothing new in the world of spam, ASCII smuggling represents a leap forward. Many spam filters had not yet adapted to this Unicode trick, giving spammers a temporary but significant advantage. The real threat, however, is to the AI and ML models that underpin modern email security. Unless a filter renders the message as an image and applies optical character recognition (OCR), these invisible tags can break up familiar words into unrecognizable fragments, bypassing both literal and semantic detection.
Microsoft has issued guidance for developers to update their filters, but the episode exposes a fundamental weakness: as defenders build smarter AI, attackers are just as quick to find new blind spots. The spike in ASCII smuggling attacks persisted for months before dropping off in May, suggesting that either filters finally caught up or attackers moved on to the next loophole.
What this episode makes clear is that the arms race between spam detection and evasion is far from over. The rapid adoption of ASCII smuggling by spammers-repurposing a technique born in the AI security world-shows that every advance in machine learning is met with an equally creative counterattack. For now, anyone relying on AI to keep their inbox safe should remember that invisible threats are often the hardest to stop, and the next wave of spam innovation is already on the horizon.
