Spammers are now using ASCII smuggling, a technique previously used to attack AI models, to hide malicious content and keywords from email filters. This method embeds invisible Unicode characters that trick both human readers and machine learning classifiers.
The widespread adoption of ASCII smuggling by spammers highlights a persistent cat-and-mouse game between malicious actors and email security systems, forcing continuous adaptation of filtering technologies to protect users from unwanted and potentially harmful content.
A technique once used to make AI attacks more stealthy, known as ASCII smuggling, is now being adopted by spammers to bypass email filters. This method involves embedding invisible Unicode characters that are readable by computers but undetectable to human eyes. These characters mimic standard ASCII characters, allowing malicious instructions or keywords to be processed by AI systems or email filters without being seen by the recipient.
Microsoft reported a significant surge in spam messages employing this technique, with daily detections of ASCII smuggling signatures jumping from approximately 21,000 to over 1.3 million in early February 2026. The deluge continued for months before declining in mid-May. Spammers leverage ASCII smuggling to obscure keywords commonly flagged by filters, such as financial terms, by inserting invisible characters within words. For instance, a filter might see "fun" and "ding" instead of "funding" if invisible characters are interspersed.
While spammers have historically used methods like zero-width spaces to evade filters, the adoption of invisible Unicode tags is likely due to their effectiveness against newer machine learning and natural language processing-based spam detection systems. These systems often process text by splitting it into tokens or sub-word pieces, and the invisible characters can disrupt this process, causing the classifier to misinterpret or miss the intended keywords. Microsoft has since released guidance for developers to improve their filters' ability to detect this type of attack.