Microsoft finds phishers using AI prompt-injection trick
Invisible Unicode characters split words like 'funding' to slip past keyword filters
Microsoft's security team went looking for AI prompt-injection attacks and found something else entirely: the same invisible-character trick, repurposed to sneak ordinary phishing emails past spam filters.
Detections on the hunting signature Microsoft built for this jumped from roughly 21,000 messages on February 8 to over 1.3 million the very next day.
ASCII smuggling normally hides instructions inside invisible Unicode tag characters so an AI model reads a command a human never sees. Microsoft's researchers, Noam Kochavi and Sarah Wolstencroft, expected to find exactly that when their signature lit up.
Instead, the invisible characters were splitting ordinary finance-themed words like "funding" apart, breaking the exact keyword match spam filters rely on without touching what the email looked like to a reader.
The level of activity peaked at 2.37 million daily messages on February 26th, using around 150 temporary finance-related sending domains. The campaign was linked by Microsoft to the same infrastructure which had previously been marked by security company Fortra in September 2025. The spammers were utilising a valid software product named ActiveCampaign to conduct spamming by using this tool’s click-tracking domains to send bulk emails and hide phishing links.
While this is an enormous number of emails per day, Microsoft claims that despite this large volume, more than 99 per cent of the emails flagged by this malware were caught by Microsoft’s anti-phishing protection software called Defender for Office 365.
There was a strict weekday schedule with a sharp decline during the weekends.
Microsoft's fix is narrow but specific: normalise Unicode tag characters, which fall in the range U+E0000 to U+E007F, before running any keyword or signature match, and treat unexpected tag-block characters in a message as suspicious on their own.
Systems that only screenshot and OCR a message for review, rather than parsing raw text, may miss the technique entirely.
