"As AI-era attack methods become better understood, threat actors may adapt them for use in more traditional threats such as phishing and spam," Noam Kochavi and Sarah Wolstencroft wrote.
Microsoft's detection timeline and scale
Redmond's security team first flagged an ASCII-smuggling signature in early February, detecting roughly 21,000 messages on February 8 and then more than 1.3 million the following day. Volumes continued at very high weekday levels through late February, peaking at more than 2.37 million messages on February 26, before entering a long, gradual decline. The campaign fell sharply after May 15 but persisted with smaller spikes through at least mid-June.
The ASCII-smuggling technique: Unicode tag spaces
Microsoft researchers said attackers used invisible Unicode tag characters — inserting "tag spaces" between letters — to split financial-lure words and evade automated filters. Rather than smuggling instructions for an AI assistant, the adversaries wrote words like "funding" as "fun⟨U+E0020⟩ding," breaking literal keyword, signature, and regex matches without changing the visible text for human readers.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCampaign characteristics: finance-themed domains and a weekday rhythm
Most of the flagged emails originated from about 150 finance-themed sender domains. The activity exhibited two notable operational traits: a strict weekday-on / weekend-off schedule and a bulk-volume pattern. Microsoft reported weekday volumes that ranged from roughly 1 to 2.37 million messages during the campaign's most intense phase, then stepped down to roughly 80 percent less per weekday by late March before the May 15 decline.
Defender guidance from Redmond's threat hunters
Microsoft's analysts recommended a combination of normalization controls and behavioral detection. Their core technical advice: "Any content that will be evaluated by keyword, signature, or regex logic should first have invisible and non-rendering Unicode code points stripped or folded, so that splicing them into a word no longer defeats the match." They added that the same control can help reduce ASCII-smuggling risks against AI assistants that ingest email content.
On behavioral detection, the researchers suggested scanning for campaign-level indicators: "bulk volume from churning, finance-themed disposable domains, on a strict weekday-on / weekend-off schedule" and "a sudden spike of tag-block characters concentrated on finance-themed senders" as a high-confidence campaign signal.
How technologists, affected enterprises, and end users should respond
- Technologists and security teams: Verify normalization and tokenization pipelines handle tag characters consistently before applying any keyword, signature, or regex logic; implement stripping or folding of invisible and non-rendering Unicode code points in mail-processing chains.
- Affected enterprises and procurement leaders: Monitor bulk spikes from finance-themed disposable domains and consider behavioral rules that flag weekday-concentrated surges of messages containing tag-block characters.
- End users and general public: Be aware that messages can appear visually normal while containing invisible characters intended to bypass automated filters; weekend silences followed by intense weekday volumes can indicate coordinated phishing activity.
The campaign illustrates a simple but consequential point made by Redmond's researchers: techniques developed or scrutinized in one security context — here, ASCII smuggling as an AI-era prompt-injection concern — can be repurposed quickly into older, high-volume scams like phishing. The resulting hybrid, combining invisible Unicode manipulation with traditional mass-mailing tactics and disposable finance-themed senders, forced defenders to think both about low-level text normalization and high-level behavioral patterns.
For defenders, the immediate next step is pragmatic: ensure pipelines normalize invisible code points and add behavioral checks tuned to rapid spikes from finance-themed domains. For attackers, the lesson is equally plain: modest technical tweaks — inserting tag characters into common lure words — can materially erode automated detection.
Microsoft’s full advisory and analysis were posted by Noam Kochavi and Sarah Wolstencroft; the original reporting can be found at The Register.
