A technique originally associated with attacks on AI systems has crossed into mass-market phishing. Microsoft security researchers say attackers are inserting invisible Unicode characters into ordinary-looking words to make malicious emails harder for security filters to recognise.
The campaign was not small. Microsoft observed the technique surge to more than a million emails on some days and peak at approximately 2.37 million messages in a single day.
For readers, the important lesson is straightforward: an email can look completely normal on screen while containing hidden characters that automated security systems may interpret differently.
What Microsoft discovered
Microsoft researchers were investigating protections against prompt-injection attacks when they noticed an unusual spike in messages containing characters from the Unicode Tags block.
These characters can represent letters while remaining invisible when text is displayed normally. The technique is often called ASCII smuggling and has attracted attention because it can be used to conceal instructions from humans while leaving them readable to automated systems or AI models.
In this campaign, however, attackers were not primarily trying to manipulate an AI assistant. They were using the same underlying trick to interfere with email security filtering.
How invisible characters can hide a phishing lure
Microsoft found invisible Unicode characters inserted inside finance-related words such as “funding”. To a person reading the message, the word can appear normal. Underneath, however, the text contains additional characters that may break the word apart before some automated filters parse it.
That matters because email defenses often analyse words, links, formatting and other signals to decide whether a message is suspicious. If attackers can change the machine-readable version of a word without noticeably changing what the recipient sees, they gain another way to attempt to evade those checks.
The concept resembles older obfuscation techniques such as inserting zero-width spaces or other unusual characters into suspicious text. What makes this case notable is the crossover of Unicode tag characters associated with AI prompt-injection research into a high-volume conventional phishing campaign.
Millions of messages at the campaign’s peak
According to Microsoft, use of these Unicode tag characters rose from roughly 5,000 to 20,000 emails per day to more than 1.3 million messages on February 9, 2026.
The activity continued at high volume for months and peaked at approximately 2.37 million emails on February 26. Microsoft observed a regular weekday-heavy pattern, consistent with scheduled bulk delivery.
Researchers linked the activity to an ongoing financial-lure phishing operation. The attackers also abused legitimate email-marketing and link-tracking infrastructure, another reminder that a familiar-looking service or link domain does not automatically make an email trustworthy.
Why this matters beyond one phishing campaign
The bigger story is the movement of attack techniques between AI security and traditional cybersecurity.
Prompt injection has created a new field of research around ways text can carry instructions or data that humans cannot easily see. As defenders learn how those techniques affect AI systems, attackers can also repurpose some of the same ideas against older technologies.
That does not mean every phishing email will suddenly defeat modern security tools. Microsoft’s research instead illustrates the continuing cat-and-mouse game between attackers trying to disguise malicious content and security systems trying to normalise and analyse it.
What readers should do
There is no practical reason for most people to inspect the Unicode code points inside every email they receive. The better defence is to avoid relying on appearance alone.
Be particularly cautious with unexpected messages involving loans, business funding, invoices, payments or urgent financial offers. Do not assume that an email is safe simply because its wording looks normal or because a link appears to pass through a recognisable service.
If a message asks you to sign in, provide credentials, download a file or make a payment, verify the request independently. Instead of following the email link, open the organisation’s official website or app yourself. Multi-factor authentication also adds an important layer of protection if credentials are stolen.
AI-era attacks are becoming ordinary cyber threats
ASCII smuggling became widely discussed because of AI prompt injection, but Microsoft’s findings show why the technique should no longer be viewed only as an AI-security problem.
Attackers are willing to borrow anything that helps their campaigns evade detection. In this case, invisible characters designed into Unicode decades ago are being combined with modern phishing infrastructure at enormous scale.
For users, the interface can remain deceptively familiar. The dangerous part may be what you cannot see.
