Credit: bluestork / Shutterstock For two years, invisible Unicode characters have been the neat trick of AI security research. You hide instructions inside them. A person sees nothing. A language model reads them and does as it is told.
Microsoft has now found somebody using the same characters for something far less clever. They were splitting up the word “funding” in spam. Noam Kochavi and Sarah Wolstencroft of Microsoft Security Research published the finding in a blog post on Thursday. At its height the campaign pushed millions of messages a weekday.
The block of characters nobody wanted The technique is called ASCII smuggling. It uses the Unicode Tags block, U+E0000 to U+E007F. That block holds an invisible shadow copy of the printable ASCII characters. U+E0041 mirrors a capital A.
U+E0061 mirrors a lowercase one. Unicode created the block for language tagging, then abandoned the idea. A later plan to use it for regional flags mostly failed too. The characters sat there, readable by software and invisible to people, until AI researchers noticed what that combination allows.
That is the prompt injection version. Hide instructions in tag characters. Embed them in a page or a document. An assistant that ingests the raw text may then follow them.
TNW has covered several. One hidden line in a Word document could rewrite figures in a spreadsheet and infect the next file. In September a researcher hijacked Claude Code by asking it to summarise a web page. Another team fed an OpenClaw agent a phishing email and got it to leak AWS keys.
In every case the trick is the same. The machine reads something the person cannot see. What this campaign did instead Microsoft built a hunting signature for exactly that, looking for tag characters in email. When the alerts spiked, the team pulled a sample and found no hidden instructions at all.
The invisible characters sat inside ordinary words. One tag space went into the middle of a financial lure term. So “funding” travelled as “fun”, an invisible character, then “ding”. The recipient sees funding.
A filter matching the literal string does not. Keyword matching is the smaller prize. Modern spam classifiers run on machine learning, and those split text into tokens before they reason about it. Insert one invisible character and a familiar token can become two unfamiliar fragments.
Or a rare sub-token the model has barely seen. “The intent is inverted, but the mechanism is similar, and a user’s suspicions are not raised,” Microsoft wrote. It did not work This is the part the campaign’s scale obscures. The evasion failed. More than 99% of the messages were caught by layers that had nothing to do with the invisible characters, according to Microsoft.
Sender and IP reputation, URL and domain checks, brand impersonation detection, authentication, and the classifiers themselves all fired. Defender also photographs message content and reads the text back with OCR, which sees what a human sees. There is a second problem for the attacker. Tag characters are so rare in ordinary email that using them is a beacon.
Microsoft says their presence is now a high-confidence indicator, which turns an evasion technique into a detection one. The first version of the signature had exactly one false-positive problem, and it is a good one. It kept firing on legitimate mail containing the flags of England, Scotland and Wales. Those three emojis are built from invisible tag characters.
The numbers, and where they disagree On 8 February the signature fired on roughly 21,000 messages. The next day it fired on more than 1.3 million. Weekday volumes then ran between 1 and 2.37 million messages for about three months. Traffic collapsed to near zero every Sunday and returned on Monday.
That is the rhythm of scheduled bulk-sending infrastructure rather than of anything human. Volumes fell roughly 80% per weekday by late March, dropped sharply after 15 May, and left a residue into mid-June. Microsoft’s own post gives two different peak dates. A chart caption puts the high above 2.3 million on 11 February.
The text three sections later says the peak was 26 February. Ars Technica reported detections reaching 2.5 million within four days of onset, which matches neither. The shape of the campaign is not in doubt. The single highest day is. 148 domains built from 28 words The mail came from about 150 disposable, finance-themed sender domains.
On 9 February alone there were 148 of them, and they are assembled from a vocabulary of 28 words. Advance, boost, business, capital, catalyst, choice, digital, direct, elevate, express, finance, funding, growth, guardian, harbor, loan, loans, loc, online, our, pulse, rocket, rush, the, united, wave, way and your. Recombine those and you get guardiangrowthfunding, digitalcapitalboost, advancefundingboost and 145 more. The busiest took 30,442 hits in a day.
None of them actually sent the mail. The campaign relayed it through ActiveCampaign, a legitimate marketing platform, which rewrites every link to route through its own tracking domains. About 92% of the volume came from a single network block belonging to that platform. Borrowing a real platform’s reputation is now standard practice.
Google sued a Chinese operation in June that used Gemini to build phishing sites and send 2.5 million scam texts. Volume is cheap. Trusted infrastructure is scarce. ActiveCampaign told Microsoft it had tested the technique against its own moderation systems.
Obfuscated messages get the same verdicts as clean ones, the company said. It also treats heavy use of invisible characters as a suspicious signal in its own right. The Unicode phase was one chapter of something longer. Fortra documented the wider operation in September 2025, when it was using the same platform to send AI-generated phishing aimed at Small Business Administration loan applicants.
That campaign ran before the tag characters appeared and continued after they stopped. Normalise before you match Microsoft’s advice is one line. Strip or fold invisible code points out of subject and body text before any keyword, signature or regex logic looks at them. The same control cuts both ways, which is the point of the whole episode.
Cleaning tag characters out of email before a filter sees them also cleans them out before an AI assistant reads the inbox. OpenAI took a blunter route in June and gave ChatGPT a Lockdown Mode for the same class of attack. The crossover is the lesson The Register drew from it too. Techniques do not stay in the domain that made them famous.
This one took about a year to travel from red-team write-ups to bulk email, and it arrived without the part that made it interesting. Also tagged with
