A technique known as ASCII smuggling has moved from attacks involving AI prompts into large-scale spam, Ars Technica reported. The method uses a block of Unicode tag characters that are almost invisible when displayed to a person but remain present in the underlying text. Software, including some language models and mail filters, can still process those code points.
Microsoft observed a sharp rise in related activity earlier this year. Daily detections increased from roughly 21,000 to more than 1.3 million on the first day of the surge, then reached 2.5 million within four days. The elevated activity continued for months before falling sharply in mid-May, according to measurements described in Microsoft’s research and reported by Ars.
Spammers used the invisible tags inside words common to finance-themed messages. A recipient might see an ordinary word such as funding, while a literal string matcher or tokenizer receives a sequence interrupted by an unexpected code point. That difference can prevent a rule from matching the visible word or cause a machine-learning classifier to split it into unusual pieces.
The mechanism previously gained attention as a way to hide prompt-injection instructions from people while leaving them legible to an AI system. Related text obfuscation is older: attackers have used zero-width spaces and nonbreaking spaces for decades. The tag block creates a newer variant because the characters can preserve a normal visual appearance while altering the byte and token sequence.
Microsoft’s counts describe signatures detected in its environment rather than the total number of messages sent across all providers. The company’s recommended defenses focus on normalizing or removing unexpected invisible characters before classification and comparing rendered text with the machine-readable form. Future campaigns may change code points or encodings once current signatures are widely filtered.