Spammers have borrowed a trick from AI prompt injection attacks and are now using it to slip junk mail past Microsoft’s filters at staggering volume. The technique, called ASCII smuggling, renders text using Unicode tags that computers read perfectly well but humans can’t see at all. A tag like U+E0041 mirrors the letter “A” — invisible to your eye, fully legible to a machine.
Microsoft watched this unfold in real time. In early February, Defender for Office was catching roughly 21,000 ASCII smuggling signatures per day. Then one day the number jumped to 1.3 million. Four days later: 2.5 million. The flood lasted for months before tapering off in mid-May.
The mechanics are almost elegant in their simplicity. “Because tag characters are invisible to humans but exist at the text-processing level, the same property that makes them useful for smuggling instructions into a model also makes them useful for obfuscating keywords before a detector evaluates them,” Microsoft explained. “The intent is inverted, but the mechanism is similar, and a user’s suspicions are not raised.”
What makes this notable is the crossover. ASCII smuggling was documented two years ago as a way to hide malicious prompts inside content destined for LLMs — a stealth layer for prompt injection attacks. Now the same invisibility cloak is being used for something far more mundane: getting spam into your inbox. It’s a reminder that offensive techniques don’t stay siloed. Once a method proves effective against one kind of filter, it migrates. The question is whether other email providers are seeing the same pattern, or if Microsoft was simply the first to notice and name it.
