Invisible Text in Email: How ASCII Smuggling Fools Filters

Spam filters read text. Humans read text too — but not the same text. Attackers have started exploiting that gap by inserting characters that computers process and people never see, and Microsoft recorded a large jump in these messages earlier this year. If your team handles invoices, payment requests or funding offers by email, this is worth ten minutes of attention.

What actually changed

As reported by Ars Technica, a trick known as ASCII smuggling has moved from AI attacks to ordinary spam. The mechanism is a block of 128 Unicode tag characters that mirror standard ASCII almost exactly. The tag point U+E0041 stands in for "A", U+E0061 for "a". Machines read them fine. By design, they are essentially invisible to a person looking at the screen.

The technique first drew attention two years ago as a way to hide prompt injections — malicious instructions planted in content that a language model will later process. The model sees the instructions; the human reading the same email sees nothing unusual.

Spammers inverted the goal but kept the method. Instead of hiding instructions, they hide breaks inside words that filters look for. Drop an invisible character into the middle of "funding" and a filter may see "fun" and "ding" as two harmless fragments. The recipient still sees "funding". The same approach can be used on dollar amounts and on words like "credit" and "term" that show up in mass campaigns.

Microsoft's numbers show the scale. Detections of ASCII smuggling signatures in Microsoft Defender for Office sat at roughly 21,000 per day, then spiked past 1.3 million on a single day in early February. Four days later they reached 2.5 million. The wave continued for months and dropped off sharply in mid-May.

Why the old defences struggle

Hiding trigger words is not new. Zero-width and non-breaking spaces have been used for the same purpose for decades. They break literal string matching and change the byte sequence that pattern-based filters hunt for.

What makes the Unicode tags interesting is what they do to modern filters. Machine learning and natural language models now do much of the work in spam and phishing classification. Those systems usually split text into tokens or sub-word pieces before reasoning about it. A clean word like "funding" maps to a familiar token. Insert an invisible character and the tokenizer may produce fragments, or rare and unknown pieces, instead. If the system normalises text first, the character is simply stripped and the word survives intact — which is exactly why normalisation matters. Microsoft notes that unless a filtering system renders the message as an image and runs OCR on it, this kind of attack can slip through.

Why it matters for a small business

Most small companies do not run their own mail infrastructure. You rely on whatever your provider filters out. That is reasonable, but it means your exposure moves when attacker technique moves, and you find out late.

The practical risk is not the spam itself. It is the message that reaches an inbox looking legitimate because the filter scored it as harmless. An accountant who receives dozens of invoices a week has little reason to treat one more as suspicious. The wording looks normal on screen. Nothing visibly signals manipulation.

There is a second angle if you have connected an AI assistant to your mail, your CRM or your document flow. The same characters that fool a spam filter can carry instructions that a model will follow. Any place where untrusted text reaches a model that can take actions deserves a look.

What to do about it

• Confirm with your email provider or IT contact that inbound filtering normalises Unicode — that is, strips or flags invisible tag characters before classification. Ask the question directly rather than assuming.
• Give your accountant and anyone handling payments one rule that does not depend on filters: bank details and payment amounts get verified through a second channel, by phone or a known contact, before money moves. No exceptions for urgency.
• Tell staff that an email can look completely clean and still be manipulated. The old advice about typos and odd formatting does not apply here, because the hidden part is invisible.
• Review any AI tool that reads incoming email, tickets or documents. If it can send messages, update records or trigger actions on its own, add human confirmation for anything with financial or external consequences.
• Keep a short internal note on where suspicious messages get reported, so a hesitant employee has somewhere to send them in thirty seconds.

The underlying lesson is not about one Unicode block. It is that the text your systems process and the text your people read are two different things, and attackers work in the gap between them. Filters will catch up; Microsoft has published guidance for developers on handling this. Your process for verifying money movements should be the layer that does not depend on that catching up.