AI 安全
ASCII Smuggling Shifts from Prompt Injection to Email Attacks as Invisible Unicode Disrupts Classifier Tokenization
Microsoft has uncovered phishing emails that insert invisible Unicode Tag characters into financial keywords, altering the tokens seen by rule-based and machine-learning classifiers. With attacks peaking at more than 2.3 million emails per day, the campaign shows that AI red-teaming techniques are beginning to migrate into conventional cybersecurity offense and defense.
[Microsoft Security Research](https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/) has disclosed a large-scale phishing campaign in which attackers inserted invisible characters from the Unicode Tags block, `U+E0000–U+E007F`, into lure words such as `funding` and `credit`. Recipients still see the complete word, but the underlying string might become `fun<U+E0020>ding`, causing exact-match rules, regular expressions, and downstream tokenizers to receive different input.
The technique originally drew attention because of AI prompt injection. Tag characters are typically not rendered by interfaces or fonts, but language models and text-processing software can still read them, allowing attackers to deliver human-invisible instructions to email agents or document-based RAG systems. The new campaign did not conceal agent instructions. Instead, it used the same representational discrepancy to break up high-weight terms: a classifier might split a common token into two subwords and a rare character, or even produce an unknown token.
Microsoft's detection signals recorded approximately 21,000 hits on February 8, 2026, rising to more than 1.3 million the following day and exceeding 2.3 million on February 11. The high-volume phase continued for roughly three months. About 96% of the hits came from sender domains formed from combinations of financial terms, but the researchers emphasized that this telemetry tracks a specific character-based technique and does not mean every hit represented a successful phishing attempt. Defender also uses reputation, URL, authentication, OCR, and other detection layers, and more than 99% of the samples were blocked by other signals as well.
The key engineering lesson is to perform normalization before applying rules, tokenization, or AI ingestion, and to treat characters from the Tags block as an anomaly signal. At the same time, systems must exempt legitimate sequences such as the England, Scotland, and Wales flag emoji to prevent false positives caused by indiscriminate removal. A follow-up analysis by [Ars Technica](https://arstechnica.com/security/2026/09/once-popular-for-attacking-ai-ascii-smuggling-is-embraced-by-spammers/) also noted that OCR alone is not a universal solution. Email agents, document parsers, and content firewalls should now test whether the visible text, normalized text, and the model's actual tokens are consistent, rather than merely adding another character-blocking rule.