ASCII smuggling technique moves from prompt injection to mass spam

A technique developed to slip malicious instructions into language models without the user noticing has been adopted by spammers to evade email filters. The method, known as ASCII smuggling, uses Unicode characters that are invisible to the human eye but readable by machines, and it now serves to hide spam keywords from detection engines just as it once hid prompts from model developers.

How it works

A block of 128 Unicode tag characters mirrors almost exactly a slice of the standard ASCII table. The character U+E0041 represents "A", U+E0061 represents "a", and so on. The critical difference: these characters are designed to be invisible to humans, while text-processing systems read them normally. When malicious instructions are written in these characters, the model recognizes them, but the human reader sees only innocuous-looking text.

The surge Microsoft detected

According to Microsoft, a sharp spike in spam messages using the technique appeared in early February. ASCII smuggling detection signatures in Microsoft Defender for Office jumped from roughly 21 thousand per day to more than 1.3 million, and within four days climbed to 2.5 million. The wave persisted for months and fell off sharply in mid-May.

Why it works for spam too

The property that makes the characters useful for smuggling prompts into a model — visibility at the text-processing layer and disappearance at the display layer — also lets spammers obscure keywords before the filtering engine examines them, the company said. The intent is opposite, but the mechanism is similar, and the recipient's suspicion is not aroused.

What it means in practice

The migration of an attack technique from the prompt-injection world into the spam world shows how a bypass tool built for one purpose is rapidly repurposed for another when the underlying technical infrastructure is identical. Email filters that rely on matching visible strings will continue to miss such messages unless they add a normalization layer that strips tag characters before inspection.