--- title: ASCII smuggling moved from AI prompt injection to email... description: A Unicode obfuscation technique called ASCII smuggling, which uses invisible tag characters (U+E0000 to U+E007F) that render as nothing to humans but are... canonical: https://daily.dev/posts/ascii-smuggling-moved-from-ai-prompt-injection-to-email-spam-campaigns-dfcjd3rrg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ASCII smuggling moved from AI prompt injection to email spam campaigns | daily.dev og:description: A Unicode obfuscation technique called ASCII smuggling, which uses invisible tag characters (U+E0000 to U+E007F) that render as nothing to humans but are... og:url: https://daily.dev/posts/ascii-smuggling-moved-from-ai-prompt-injection-to-email-spam-campaigns-dfcjd3rrg og:image: https://api.daily.dev/og/posts/dfCjd3RRg.png og:image:alt: ASCII smuggling moved from AI prompt injection to email spam campaigns og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ASCII smuggling moved from AI prompt injection to email spam campaigns **[Collections](https://daily.dev/sources/collections)** · 3 min read · 1 upvotes · 1 comments ## Summary A Unicode obfuscation technique called ASCII smuggling, which uses invisible tag characters (U+E0000 to U+E007F) that render as nothing to humans but are processed normally by machines, has jumped from AI prompt injection attacks into email spam campaigns. Microsoft Defender for Office 365 saw a hunting signature spike from about 21,000 hits per day to over 2.3 million within three days in early February, peaking near 2.5 million before subsiding by mid-May. Spammers embed the hidden characters inside words like 'funding' and 'loan' to fool spam filters and ML classifiers. For developers building AI agent pipelines, standard Unicode normalization does not strip these tag characters and tokenizers handle them inconsistently, so explicit stripping is recommended, with an exception carved out for UK subdivision flag emojis which rely on the same mechanism. ## Content ## The technique Somewhere between AI security research and a spam campaign, a trick called ASCII smuggling crossed over into mainstream abuse. The technique uses a block of 128 Unicode "tag" characters (U+E0000 to U+E007F) that mirror standard ASCII text but are completely invisible to human readers. A word like "funding" can be split with these characters so it looks normal on screen while appearing as fragmented gibberish to keyword filters and ML classifiers. The characters are processed by computers but never rendered visually — which is exactly what makes them useful for evasion. Originally, security researchers demonstrated the trick against large language models: embed hidden instructions in text using tag characters, and an AI agent processing that text might follow them without the user ever seeing them. That's the prompt injection angle. But the same invisibility property works just as well against spam filters. ## What Microsoft caught Microsoft Defender for Office 365 had a hunting signature for ASCII smuggling — built partly with AI prompt injection in mind — and in early February it started firing at an unusual rate. Detections jumped from roughly 21,000 hits per day to over 1.3 million, then kept climbing to around 2.3–2.5 million within four days. The campaign ran from roughly February through June, peaking at about 2.37 million messages on a single weekday. The emails pushed finance-themed content, with tag characters inserted into keywords like "funding" and "loan" to break up the strings that spam filters look for. The domains used were disposable, built from a 28-word vocabulary, and the messages were relayed through ActiveCampaign — a legitimate marketing platform — to borrow its sender reputation. Despite the scale, the campaign mostly failed. More than 99% of messages were caught by other detection layers: reputation checks, OCR, brand impersonation detection. And here's the irony — tag characters are so rare in legitimate email that their presence became a high-confidence detection signal in itself. The evasion technique ended up being a fingerprint. ## Why it matters for AI pipelines The spam campaign is contained, but the underlying technique isn't going away. For anyone building AI agents that ingest untrusted text — emails, documents, web content — ASCII smuggling is a real concern. Standard Unicode normalization (NFC or NFD) doesn't strip tag characters. Tokenizers handle them inconsistently; some collapse them, some don't. That inconsistency is the attack surface: a hidden instruction embedded in tag characters might survive preprocessing and reach a model intact. Microsoft's recommendation is straightforward: strip tag characters before text reaches a model or any keyword/regex matching runs. One fix covers both the spam evasion and the prompt injection variant. One edge case worth knowing: UK subdivision flag emojis (like the flags for England, Scotland, and Wales) actually rely on tag characters as part of their encoding. Any stripping logic needs to account for that, or you'll break legitimate emoji rendering. ## The bigger picture What's interesting here isn't just the technique — it's the direction of travel. A method developed in AI security research got picked up by spammers within a relatively short window. The same properties that make tag characters useful for hiding instructions from AI models make them useful for hiding keywords from spam filters. The attack surface is the same; only the target changes. For defenders, the lesson is that detection signatures built for AI-specific threats can catch conventional abuse too — and vice versa. Microsoft's prompt injection detector ended up documenting a phishing campaign. That's a useful reminder that these categories aren't as separate as they might seem. ## Questions this post answers ### What is ASCII smuggling and how does it evade spam filters? ASCII smuggling uses invisible Unicode tag characters (U+E0000 to U+E007F) that mirror ASCII text but never render visually, so keywords like 'funding' or 'loan' can be split apart to look normal to a human reader while appearing as fragmented gibberish to keyword filters and ML classifiers. It works because standard Unicode normalization (NFC/NFD) doesn't strip these characters, and tokenizers handle them inconsistently. _daily.dev surfaces techniques like this for developers hardening AI pipelines against untrusted text input._ ### How did Microsoft Defender detect the ASCII smuggling spam campaign? Microsoft Defender for Office 365 had a hunting signature for ASCII smuggling originally built with AI prompt injection in mind, and in early February it began firing at an unusual rate, jumping from about 21,000 hits per day to over 1.3 million, then climbing to 2.3-2.5 million within four days. The campaign ran from February through June, peaking around 2.37 million messages in a single day, but over 99% were still caught by other detection layers. _Security teams tracking novel evasion techniques like this can follow the space on daily.dev._ ### How should developers strip Unicode tag characters without breaking emoji rendering? Strip tag characters before text reaches a model or any keyword/regex matching runs, but account for the fact that UK subdivision flag emojis, such as those for England, Scotland, and Wales, rely on tag characters as part of their encoding. Stripping logic that doesn't exempt these will break legitimate emoji rendering while still closing off the ASCII smuggling attack surface. _Developers building input sanitization for AI agents can track edge cases like this via daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@trevorsuna** · 0 upvotes > Explicitly stripping Unicode tag characters before untrusted text reaches a classifier or model seems like the right baseline, but the UK flag emoji exception shows why blanket sanitization needs tests. I’d add tokenizer-specific fixtures and log rejected characters so the defense stays observable instead of becoming a silent text mutation. ## Similar posts on daily.dev - [How AI-Generated Content is Fueling Next-Gen Phishing and BEC Attacks: Detection and Defense Strategies](https://daily.dev/posts/how-ai-generated-content-is-fueling-next-gen-phishing-and-bec-attacks-detection-and-defense-strateg-hjbgtmbld) · Security Boulevard · 0 upvotes · 0 comments - [When Email Speaks to Machines](https://daily.dev/posts/when-email-speaks-to-machines-tdcjsmpjk) · InfoSec Write-ups · 0 upvotes · 0 comments - [SPONSORED: Fighting GenAI with GenAI: The New Email Security Landscape](https://daily.dev/posts/sponsored-fighting-genai-with-genai-the-new-email-security-landscape-qa7s0w6gi) · The Register · 0 upvotes · 0 comments - [AI Agent Phishing: Proofpoint's New Defense](https://daily.dev/posts/ai-agent-phishing-proofpoint-s-new-defense-w6mkbgwod) · IEEE Spectrum · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/ascii-smuggling-moved-from-ai-prompt-injection-to-email-spam-campaigns-dfcjd3rrg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"ASCII smuggling moved from AI prompt injection to email spam campaigns","url":"https://daily.dev/posts/ascii-smuggling-moved-from-ai-prompt-injection-to-email-spam-campaigns-dfcjd3rrg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ascii-smuggling-moved-from-ai-prompt-injection-to-email-spam-campaigns-dfcjd3rrg"},"datePublished":"2026-09-05T00:59:13.633Z","dateModified":"2026-09-13T20:05:50.787Z","description":"A Unicode obfuscation technique called ASCII smuggling, which uses invisible tag characters (U+E0000 to U+E007F) that render as nothing to humans but are...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b267d1b2b405b8ecbf9dd09ad9634974?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b267d1b2b405b8ecbf9dd09ad9634974?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/ascii-smuggling-moved-from-ai-prompt-injection-to-email-spam-campaigns-dfcjd3rrg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,prompt-injection","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"ASCII smuggling moved from AI prompt injection to email spam campaigns"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/ascii-smuggling-moved-from-ai-prompt-injection-to-email-spam-campaigns-dfcjd3rrg","comment":[{"@type":"Comment","text":"Explicitly stripping Unicode tag characters before untrusted text reaches a classifier or model seems like the right baseline, but the UK flag emoji exception shows why blanket sanitization needs tests. I’d add tokenizer-specific fixtures and log rejected characters so the defense stays observable instead of becoming a silent text mutation.","datePublished":"2026-09-06T01:51:47.328Z","url":"https://daily.dev/posts/dfCjd3RRg#c-oChiOGice","author":{"@type":"Person","name":"Trevor Suna","url":"https://daily.dev/trevorsuna","image":"https://media.daily.dev/image/upload/s--dZ7gXxpp--/f_auto/v1784081551/avatars/avatar_EMoP47rpuw8DNjhp6R1b6?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ascii-smuggling-moved-from-ai-prompt-injection-to-email-spam-campaigns-dfcjd3rrg#faq","mainEntity":[{"@type":"Question","name":"What is ASCII smuggling and how does it evade spam filters?","acceptedAnswer":{"@type":"Answer","text":"ASCII smuggling uses invisible Unicode tag characters (U+E0000 to U+E007F) that mirror ASCII text but never render visually, so keywords like 'funding' or 'loan' can be split apart to look normal to a human reader while appearing as fragmented gibberish to keyword filters and ML classifiers. It works because standard Unicode normalization (NFC/NFD) doesn't strip these characters, and tokenizers handle them inconsistently. daily.dev surfaces techniques like this for developers hardening AI pipelines against untrusted text input."}},{"@type":"Question","name":"How did Microsoft Defender detect the ASCII smuggling spam campaign?","acceptedAnswer":{"@type":"Answer","text":"Microsoft Defender for Office 365 had a hunting signature for ASCII smuggling originally built with AI prompt injection in mind, and in early February it began firing at an unusual rate, jumping from about 21,000 hits per day to over 1.3 million, then climbing to 2.3-2.5 million within four days. The campaign ran from February through June, peaking around 2.37 million messages in a single day, but over 99% were still caught by other detection layers. Security teams tracking novel evasion techniques like this can follow the space on daily.dev."}},{"@type":"Question","name":"How should developers strip Unicode tag characters without breaking emoji rendering?","acceptedAnswer":{"@type":"Answer","text":"Strip tag characters before text reaches a model or any keyword/regex matching runs, but account for the fact that UK subdivision flag emojis, such as those for England, Scotland, and Wales, rely on tag characters as part of their encoding. Stripping logic that doesn't exempt these will break legitimate emoji rendering while still closing off the ASCII smuggling attack surface. Developers building input sanitization for AI agents can track edge cases like this via daily.dev."}}]} ```