ASCII smuggling: invisible Unicode migrates from AI attacks to spam

Microsoft has reported that a technique known as ASCII smuggling has changed roles. It was originally used for stealthy attacks on AI agents, but it has now become a weapon for spammers looking to bypass the filters of email platforms.

How it works

The method is built on a special range of 128 Unicode tag characters that almost exactly mirrors the ASCII table, but with one difference: these characters are read by the computer while remaining all but invisible to a human. For example, the tag U+E0041 corresponds to the letter “A,” and U+E0061 to “a.”

Two years ago the trick made its name as a way to disguise prompt injection — malicious instructions for large language models. Written out in invisible tags, they were recognized by the model yet stayed unnoticed by anyone reading the message.

Same mechanism, opposite intent

As Microsoft explains, the very property that made the tags convenient for covertly passing commands to a model also makes it possible to hide keywords from detectors. The intent is the opposite, but the mechanism is the same — and no suspicion is aroused in the user.

In early February, Microsoft Defender for Office recorded a sharp spike: the number of hits on the ASCII smuggling signature jumped from roughly 21,000 a day to more than 1.3 million, and four days later reached 2.5 million. The flood held for months and dropped off sharply in mid-May.

Spammers insert invisible characters inside the words that filters usually look for — dollar amounts, or the words “credit” or “term.” So, if you wedge an invisible character into the middle of the word “funding,” the filter reads “fun” and “ding,” while the recipient still sees “funding.”

Why the old tricks are no longer the main point

Spammers learned to disguise trigger words long ago — for decades they have used zero-width spaces and non-breaking spaces to throw off string searches and to change the byte sequence for regex filters. The new invisible tags have probably caught on because some filters have not yet learned to recognize them.

But the main goal, Microsoft notes, is not to evade a literal string match, but to fool systems based on machine learning and natural language processing, which are increasingly used to classify spam and phishing. Such a classifier normally breaks text into tokens; a familiar lure word like “funding” is represented as a familiar token. But insert an invisible U+E0020 in the middle, and the tokenizer no longer sees the old unit: it splits the text into “fun,” a strange tag character, and “ding,” producing rare subtokens — and if normalization runs first, the character is simply stripped out. The only thing that helps against such an attack, according to Microsoft, is recognizing the text from an image of the email (OCR).

In its post, the company offered recommendations for developers on how to teach filters to account for ASCII smuggling.

Source: Ars Technica