Microsoft measured a phishing campaign that peaked at 2.37 million messages a day using the invisible Unicode trick built for prompt injection

Microsoft Security published a study on 3 September 2026 of a phishing campaign that borrowed a technique from AI prompt injection attacks. The attackers hid invisible characters from the Unicode Tags block inside ordinary-looking words, so the text a person reads and the text a filter matches are no longer the same string. Microsoft's research team, with Noam Kochavi and Sarah Wolstencroft credited, put real volume figures on it.

What the numbers say

Microsoft dates the onset to 9 February 2026, when daily volume went from roughly 21,000 messages on 8 February to more than 1.3 million the next day. The peak was 2.37 million messages on 11 February. The high-volume phase ran about three months and ended on 15 May 2026. Around 150 finance-themed sender domains were involved, and a single network block, 173.236.20.0/24, carried about 92 percent of the measured activity.

The technique itself is narrow. The Unicode Tags block runs from U+E0000 to U+E007F and contains a shadow copy of printable ASCII that renders as nothing. This campaign used one character from it, U+E0020, the tag space, dropped into the middle of financial words. Microsoft's example is "funding" written with an invisible character between "fun" and "ding". Targeted words included funding, capital, loan, finance, business, growth, advance and boost.

Microsoft says over 99 percent of these messages were still flagged, by sender reputation, IP and URL checks, machine learning classification and authentication, rather than by content matching. The company also says it built hunting logic specifically for tag-character detection.

The part that is not about email

The reason this belongs on a developer's desk has little to do with spam filters. The same block of characters is what made prompt injection stealthy two years ago: instructions a reviewer cannot see, sitting inside text a model reads literally. This campaign is the same primitive pointed at a different target, which is a useful demonstration that the trick works against any component that compares strings.

Microsoft's own advice names the case directly. It recommends stripping or normalising Unicode tag characters before applying content signatures, treating the presence of the tag block as a high-anomaly signal, and applying that normalisation upstream of AI ingestion.

What a team should take from it

If your product accepts text from outside and passes it to a model, an agent, a rules engine, or a moderation check, the question is whether anything in that path normalises Unicode before the comparison happens. In most codebases the answer is no, because nobody wrote a rule about a character range that renders as nothing.

That is a small change with a clear test attached. Feed your own pipeline a string carrying tag characters inside a keyword you filter on, and see whether the filter still fires. If it does not, you have found the gap before someone else does, and Microsoft has just published three months of evidence that people are looking for it.

Source

ASCII smuggling crosses over from AI prompt injection to phishing evasion, Microsoft Security Blog, 3 September 2026.