ASCII Smuggling Hit 2.37M Phishing Emails a Day

A Trick Built to Fool AI Now Fools Human Filters

Microsoft's Security Blog disclosed on September 3, 2026 that a technique built to slip hidden instructions past AI models is now being used to slip phishing keywords past ordinary spam filters. The technique, known as ASCII smuggling, hides text inside invisible Unicode characters from the Tags block, a range originally added for language-tagging purposes and later adopted by prompt-injection researchers because it renders as nothing in any normal font or interface. A string can carry an invisible instruction that a human reader never sees but that a language model still processes character by character.

Attackers found a second use for the same invisible range: breaking up a filtered word so no scanner ever sees the whole thing. Instead of hiding an instruction, they insert a single invisible tag character, such as the TAG SPACE character at U+E0020, in the middle of a trigger word like "funding," so the visible text still reads "funding" to a human but the underlying string a filter parses is split into two fragments that match no blocklist entry. Traditional keyword filters and many AI-based content classifiers both process the same literal string, so the same one-character trick fooled both.

A Legitimate Platform, an SBA Lure, and a 2.37 Million-Email Peak

Microsoft tied the surge to a single, well-organized campaign that abused the legitimate email-marketing platform ActiveCampaign for bulk delivery. The actual mail was relayed through infrastructure associated with ActiveCampaign, and the attackers reused the platform's own URL-rewriting and click-tracking system, routing links through the acemlnd.com and activehosted.com domains, so that a suspicious destination looked like an ordinary marketing-platform tracking link. Microsoft linked the campaign to a broader, ActiveCampaign-delivered, SBA-themed phishing operation that the security firm Fortra had documented earlier, in which AI-generated lure emails offered business loans, lines of credit, and advance-funding deals to Small Business Administration loan applicants and other small-business owners, then directed them to sites collecting revenue figures, requested loan amounts, credit scores, and contact details.

The volume told its own story. The day before the campaign's onset, Microsoft's detection signature for this Unicode Tags-block abuse fired on a baseline of roughly 5,000 to 20,000 messages a day; on February 9, 2026 that jumped to more than 1.3 million in a single day, the high-volume phase held for roughly three months, and it peaked at 2.37 million messages on February 26, 2026 before dropping sharply after May 15, 2026.

Beyond the Numbers: One Gap, Two Kinds of Filter

The uncomfortable finding here is not that phishers found a new trick, but that the trick works against two completely different kinds of defense for the same underlying reason. A keyword-matching spam filter built in the 1990s and a machine-learning content classifier built in 2026 both operate on the same assumption: that the string of characters a system reads is the same string a human sees, and that matching the visible word is enough to catch the intent behind it. ASCII smuggling breaks that assumption for both defenses at once, because it never removes the visible word. It just inserts a character no interface renders, so the human sees "funding" while the machine sees two fragments that mean nothing to a blocklist.

That gap does not stop at one campaign aimed at Small Business Administration loan applicants. Any European or UK business running Microsoft 365 or Google Workspace content filtering, or building an AI email assistant that reads raw inbox content before summarizing or acting on it, depends on the same assumption: that what the filter parses matches what the reader sees. Microsoft's own recommendation is to normalize, meaning strip or flag Unicode Tags-block characters, before a message reaches either a spam signature or an AI model, precisely because the same invisible character defeats both. This campaign targeted US loan applicants with English-language lures, and nothing in the reporting suggests an EU-specific incident yet, but the technique itself does not care what language or target list it is pointed at, so the operator question is worth asking now rather than after the first European domain shows up in someone else's disclosure.

Read next: If You Run Zimbra, August 21 Changed Your Risk  |  Windows Gets a Cloud-Free Way to Run Big AI