Spammers Adopt ASCII Smuggling to Evade Microsoft Filters

Microsoft security researchers recently observed a massive surge in spam campaigns leveraging ASCII smuggling, a technique originally popularized for stealthy AI prompt injection attacks. According to Microsoft Defender for Office, daily detections of ASCII smuggling signatures skyrocketed in early February, jumping from approximately 21,000 to over 1.3 million in a single day. Within four days, the volume peaked at 2.5 million daily detections, maintaining a heavy volume for months before dropping sharply in mid-May.

The method exploits a specific block of 128 Unicode tag characters, such as U+E0041 for capital A and U+E0061 for lowercase a. These characters mirror standard ASCII text but are designed to remain invisible to human readers while remaining fully readable by computers. Spammers insert these invisible tags, like the U+E0020 space tag, into sensitive keywords such as credit, term, or funding. While a human recipient sees the word funding normally, a security filter might read it as two separate words, fun and ding, thereby failing to trigger spam alerts.

This shift represents a direct challenge to modern machine learning and natural language processing models used in spam classification. Traditional filters that rely on tokenization are easily fooled because the hidden characters disrupt the expected sequence of sub-tokens. For security practitioners and AI developers, this development means standard text-based classifiers are no longer sufficient. To counter this evasion tactic, developers must update their preprocessing pipelines to normalize text or strip out the deprecated Unicode Tags block before feeding email content into machine learning classifiers.