For two years, invisible Unicode characters have been the neat trick of AI security research. You hide instructions inside them. A person sees nothing. A language model reads them and does as it is told. Microsoft has now found somebody using the same characters for something far less clever. They were splitting up the word “funding” in spam.

Noam Kochavi and Sarah Wolstencroft of Microsoft Security Research published the finding in a blog post on Thursday. At its height the campaign pushed millions of messages a weekday. The technique is called ASCII smuggling. It uses the Unicode Tags block, U+E0000 to U+E007F. That block holds an invisible shadow copy of the printable ASCII characters. U+E0041 mirrors a capital A. U+E0061 mirrors a lowercase one.

The block of characters nobody wanted

Unicode created the block for language tagging, then abandoned the idea. A later plan to use it for regional flags mostly failed too. England, Scotland, and Wales flags, for example, are built from invisible tag characters. The characters sat there, readable by software and invisible to people, until AI researchers noticed what that combination allows.

That is the prompt injection version. Hide instructions in tag characters. Embed them in a page or a document. An assistant that ingests the raw text may then follow them. TNW has covered several. One hidden line in a Word document could rewrite figures in a spreadsheet and infect the next file. In September a researcher hijacked Claude Code by asking it to summarise a web page. Another team fed an OpenClaw agent a phishing email and got it to leak AWS keys. In every case the trick is the same. The machine reads something the person cannot see.

What this campaign did instead

Microsoft built a hunting signature for exactly that, looking for tag characters in email. When the alerts spiked, the team pulled a sample and found no hidden instructions at all. The invisible characters sat inside ordinary words. One tag space went into the middle of a financial lure term. So “funding” travelled as “fun”, an invisible character, then ”ing”. The recipient sees funding. A filter matching the literal string does not.

Keyword matching is the smaller prize. Modern spam classifiers run on machine learning, and those split text into tokens before they reason about it. Insert one invisible character and a familiar token can become two unfamiliar fragments. Or a rare sub-token the model has barely seen. “The intent is inverted, but the mechanism is similar, and a user’s suspicions are not raised,” Microsoft wrote.

It did not work

This is the part the campaign’s scale obscures. The evasion failed. More than 99% of the messages were caught by layers that had nothing to do with the invisible characters, according to Microsoft. Sender and IP reputation, URL and domain checks, brand impersonation detection, authentication, and the classifiers themselves all fired. Defender also photographs message content and reads the text back with OCR, which sees what a human sees.

There is a second problem for the attacker. Tag characters are so rare in ordinary email that using them is a beacon. Microsoft says their presence is now a high-confidence indicator, which turns an evasion technique into a detection one. The first version of the signature had exactly one false-positive problem, and it is a good one. It kept firing on legitimate mail containing the flags of England, Scotland and Wales. Those three emojis are built from invisible tag characters.

The numbers, and where they disagree

On 8 February the signature fired on roughly 21,000 messages. The next day it fired on more than 1.3 million. Weekday volumes then ran between 1 and 2.37 million messages for about three months. Traffic collapsed to near zero every Sunday and returned on Monday. That is the rhythm of scheduled bulk-sending infrastructure rather than of anything human. Volumes fell roughly 80% per weekday by late March, dropped sharply after 15 May, and left a residue into mid-June.

Microsoft’s own post gives two different peak dates. A chart caption puts the high above 2.3 million on 11 February. The text three sections later says the peak was 26 February. Ars Technica reported detections reaching 2.5 million within four days of onset, which matches neither. The shape of the campaign is not in doubt. The single highest day is.

148 domains built from 28 words

The mail came from about 150 disposable, finance-themed sender domains. On 9 February alone there were 148 of them, and they are assembled from a vocabulary of 28 words. Advance, boost, business, capital, catalyst, choice, digital, direct, elevate, express, finance, funding, growth, guardian, harbor, loan, loans, loc, online, our, pulse, rocket, rush, the, united, wave, way and your. Recombine those and you get guardiangrowthfunding, digitalcapitalboost, advancefundingboost and 145 more. The busiest took 30,442 hits in a day.

None of them actually sent the mail. The campaign relayed it through ActiveCampaign, a legitimate marketing platform, which rewrites every link to route through its own tracking domains. About 92% of the volume came from a single network block belonging to that platform. Borrowing a real platform’s reputation is now standard practice. Google sued a Chinese operation in June that used Gemini to build phishing sites and send 2.5 million scam texts. Volume is cheap. Trusted infrastructure is scarce.

ActiveCampaign told Microsoft it had tested the technique against its own moderation systems. Obfuscated messages get the same verdicts as clean ones, the company said. It also treats heavy use of invisible characters as a suspicious signal in its own right.

The Unicode phase was one chapter of something longer. Fortra documented the wider operation in September 2025, when it was using the same platform to send AI-generated phishing aimed at Small Business Administration loan applicants. That campaign ran before the tag characters appeared and continued after they stopped.

Normalise before you match

Microsoft’s advice is one line. Strip or fold invisible code points out of subject and body text before any keyword, signature or regex logic looks at them. The same control cuts both ways, which is the point of the whole episode. Cleaning tag characters out of email before a filter sees them also cleans them out before an AI assistant reads the inbox. OpenAI took a blunter route in June and gave ChatGPT a Lockdown Mode for the same class of attack.

The crossover is the lesson The Register drew from it too. Techniques do not stay in the domain that made them famous. This one took about a year to travel from red-team write-ups to bulk email, and it arrived without the part that made it interesting.

Understanding Unicode tag characters is essential for defenders. The tag character range was originally intended to identify language of text, but fell into disuse. Each invisible character has a codepoint that corresponds to a printable ASCII character. Security researchers realized that a large language model processes these invisible codepoints as though they were ordinary text. A human reading the rendered page sees nothing unusual, but the model receives hidden words, phrases, or commands. This asymmetry made the technique a favorite for prompt injection attacks. Attackers could place instructions inside content that a person would never read, and the assistant would obey.

In the spam campaign, attackers used the same asymmetry for a simpler purpose: evade string-based filters and confuse tokenizers. A tokenizer is the part of a machine-learning system that breaks text into chunks. If the word “funding” is split into “fun” and “ding” by an invisible character, the tokenizer may produce two odd tokens that are less recognizable. Spam filters that rely on token frequency or bag-of-words models could assign lower suspicion scores. The attackers were not necessarily trying to defeat modern AI classifiers entirely. They were attempting to stay under the radar long enough for their messages to reach users. The scale of the campaign—at times more than two million messages per day—suggests the spammers expected most messages to be blocked. Even a tiny improvement in delivery rate can make a mass campaign profitable. But the effort failed according to Microsoft, because multiple layers of defense did not depend on reading the literal string.

This is an important lesson for security teams. AI-based email security is powerful, but it is not the only control that matters. Reputation systems, authentication checks, and behavioral analysis all contributed to the high catch rate. The invisible-character technique also had a distinctive fingerprint: ordinary email almost never contains Unicode tag characters. Once Microsoft added a rule to flag their presence, the evasion technique became a detection trigger. This is a common fate in security. When an adversary adopts a rare feature that most legitimate traffic does not use, that feature itself acts as a beacon.

The campaign’s infrastructure also reveals how commodity spam has evolved. The disposable sender domains were generated from a small set of financial words. The operators registered dozens of similar domains to avoid domain blocklists. They sent mail through ActiveCampaign, a legitimate marketing platform, to borrow its sender reputation. Attackers increasingly abuse cloud services and legitimate platforms because their IP addresses are not pre-blocked. This creates a difficult problem for those platforms, which must balance open marketing access with abuse prevention. ActiveCampaign claims it tested the technique and found obfuscated messages still received the same verdicts as clean ones, but the very need for such testing shows that spam continues to pressure legitimate infrastructure.

The same Unicode tag characters have also been observed in other contexts, from AI red-team exercises to email security research. The technique’s power lies in its invisibility. End-user email clients typically render tag characters as zero-width, so recipients see the intended word or phrase. This makes the attack difficult for humans to identify by eye. Security vendors have responded by building detectors for invisible characters. Microsoft’s advice is to remove or normalize such codepoints before applying any content filters. By doing so, the filter sees the same text a human would see, eliminating the gap between the rendered message and the raw message.

The crossover from AI attacks to spam has broader implications. Security research often focuses on novel attacks against emerging technologies, but attackers tend to reuse techniques in more mundane ways. The same Unicode trick that could exfiltrate credentials from an AI agent was used simply to hide a word in a financial spam email. This pattern suggests that defenders should expect techniques to migrate from one problem domain to another. A method that works against a large language model can also work against traditional spam filters, if only because both rely on processing raw text. In this case, the migration was detected quickly because the technique left a digital trail. But the underlying issue—invisible characters embedded in content—remains a concern for any system that processes text.

Source:TNW | Data-security News