Spammers Adopt ASCII Smuggling to Bypass Email Security Filters

A sophisticated obfuscation technique originally designed to compromise artificial intelligence agents has been repurposed by spammers to evade modern email security filters. Known as ASCII smuggling, the method utilizes a specific block of Unicode tags that are invisible to human readers but fully readable by computer systems. By embedding these invisible characters within common words, attackers can effectively mask malicious keywords from automated detection systems, allowing spam and phishing campaigns to reach intended targets without triggering security alerts.

The technique relies on a range of 128 Unicode tags that mirror standard ASCII characters. While these tags were originally intended for language or regional identification, they have been largely abandoned for their initial purposes, leaving them available for exploitation. Because these characters do not display in most user interfaces, they create a covert channel that allows malicious instructions or keywords to bypass traditional text-based filtering mechanisms that rely on literal string matching or standard tokenization processes.

ASCII smuggling first gained prominence approximately two years ago as a stealthy method for executing prompt injection attacks against large language models (LLMs). In those instances, attackers embedded malicious instructions within invisible Unicode tags to manipulate AI behavior without alerting human oversight. The transition from AI-focused attacks to mass spam distribution marks a significant shift in how this vulnerability is being weaponized by threat actors.

Microsoft researchers observed a dramatic surge in the use of this technique earlier this year. According to data from Microsoft Defender for Office, detections of ASCII smuggling signatures spiked from a baseline of roughly 21,000 per day to over 1.3 million on a single day in early February. Within four days of this initial spike, detections climbed to 2.5 million, indicating a rapid and widespread adoption of the tactic by spam operators. This high-volume activity persisted for several months before declining sharply in mid-May.

Modern spam and phishing classification systems increasingly rely on machine learning and natural language processing models to identify threats. These models often process text by splitting it into tokens or sub-word pieces for efficiency. By inserting invisible Unicode characters into the middle of common lure terms, attackers can disrupt the tokenization process. For example, inserting an invisible U+E0020 tag into the word “funding” may cause a classifier to interpret the text as “fun,” an unexpected tag, and “ding,” effectively breaking the model's ability to recognize the original, flagged term.

Microsoft explained the mechanism in a recent security advisory: “Because tag characters are invisible to humans but exist at the text-processing level, the same property that makes them useful for smuggling instructions into a model also makes them useful for obfuscating keywords before a detector evaluates them.” The company noted that unless a filtering system employs optical character recognition (OCR) on a visual image of the message, it may fail to identify the obfuscated content. This creates a significant challenge for standard email classifiers that do not reason over text exactly as a human perceives it.

The Unicode block used in these attacks has a long, albeit troubled, history within the standard. Originally intended to create language tags, the block was later repurposed to represent country codes for flag emojis. However, these plans were largely abandoned or relegated to niche use cases, leaving the 128-character block effectively orphaned. Independent researchers, such as Riley Goodside of Scale AI, were among the first to document that these tags could be understood as text by LLMs even when they remain invisible to human users.

While some observers have debated whether these characters are officially “deprecated,” the consensus among security researchers is that their lack of widespread implementation in user interfaces makes them an ideal covert channel. The characters are derived from ISO 3166-2 standards, but their current utility for attackers stems from the fact that many security filters were simply not programmed to account for their presence. As spam filters evolve to detect these specific Unicode sequences, the effectiveness of the technique may diminish, but its current use highlights the ongoing cat-and-mouse game between attackers and security developers.

To counter the rise of ASCII smuggling, security teams are being urged to update their filtering logic to explicitly account for invisible Unicode tags. Microsoft’s recent guidance provides developers with strategies to normalize text input before it reaches the classification layer. By stripping out or normalizing these invisible characters, systems can reconstruct the intended text, allowing models to evaluate the content accurately without being misled by the hidden tags.

Despite these mitigation efforts, the history of spam suggests that attackers will continue to seek new ways to camouflage malicious content. The use of zero-width spaces and non-breaking spaces has been a staple of spam evasion for decades, and ASCII smuggling is merely the latest iteration of this long-standing practice. As long as there is a gap between how humans read text and how machines process it, attackers will likely continue to exploit these discrepancies to deliver unwanted or malicious communications.