Phishers reuse AI prompt-injection trick to dodge filters

Microsoft's security team found a phishing campaign that repurposed a technique first documented as an AI prompt-injection risk: hiding text from filters using invisible Unicode tag characters. In a September 3 writeup, researchers Noam Kochavi and Sarah Wolstencroft described attackers inserting a hidden character, U+E0020, in the middle of financial lure words, turning "funding" into "fun[hidden]ding" on the wire while it still reads as plain text to a recipient.

The method, known as ASCII smuggling, was originally studied as a way to slip instructions past an AI model's guardrails: a human sees clean text while a model reading the same content decodes hidden characters as commands. Microsoft's researchers said this campaign is the first large-scale case of the same trick used against conventional keyword-matching spam filters instead.

The volume was significant. Microsoft's data shows the campaign peaked around 2.3 million messages on February 11, 2026, stayed elevated on a strict weekday schedule for about three months, and tapered off by mid-May. Roughly 150 finance-themed disposable sender domains were involved, and about 92% of the traffic traced back to a single IP block. Messages were relayed through the marketing platform ActiveCampaign, which told Microsoft that messages containing invisible Unicode characters receive the same moderation verdicts as their unobfuscated equivalents, and that heavy use of the technique is itself treated as a suspicious signal.

For anyone building AI agents that ingest untrusted text (scraped pages, inbound email, user-submitted documents), the underlying lesson predates this campaign: content that looks clean to a human can carry hidden instructions or hidden intent a naive parser won't catch. This campaign is a sign that the same evasion character set is now spreading beyond AI-targeted attacks into ordinary filter evasion, so a strip-invisible-characters step is worth adding to any pipeline that treats incoming text as trusted, not just to the AI-specific parts of it.