For two years, invisible Unicode characters have been the neat trick of AI security research. A researcher hides instructions inside them. A person reading the text sees nothing unusual, but a language model ingests the raw characters and can be steered into following hidden commands. Microsoft has now found somebody using the same characters for something far less clever: they were splitting the word 'funding' in spam emails.
Microsoft Security Research published the finding in a blog post on Thursday. At its height, the campaign pushed millions of messages per weekday. But the invisible characters were not carrying any secret payload. They were merely inserted into ordinary words to make those words invisible to filters that match literal text. The recipient still sees the word 'funding.' The filter sees something like 'fun' followed by an empty space and then 'ding.'
The invisible alphabet
The technique is called ASCII smuggling. It exploits a block of Unicode code points known as the Tags block, which runs from U+E0000 to U+E007F. That block holds invisible shadow copies of the printable ASCII characters. U+E0041 mirrors a capital A, while U+E0061 mirrors a lowercase one. The characters are rendered as nothing on screen, but they are still real characters that software can parse.
Unicode originally created the Tags block for language tagging. The idea was to let text carry invisible metadata about the language or script used. That plan was abandoned. Later, the block was proposed for building emoji flags, but that idea mostly failed too. The characters sat in a strange limbo: readable by software and completely invisible to people. For years, they were ignored by almost everyone except researchers looking for quirks in how text processors handle obscure code points.
From prompt injection to spam
AI security researchers eventually realized what that combination allows. The invisible characters can be used to hide instructions from human reviewers while still feeding those instructions directly into a language model. This is a type of prompt injection. The model sees the hidden text as part of the legitimate input and may follow it even though the user never intended to issue that command.
Several examples have been documented. Hidden lines inside a Word document can rewrite figures in a spreadsheet or infect the next file that is opened. A researcher hijacked a Claude Code assistant by asking it to summarize a malicious web page. Another team fed an OpenClaw agent a phishing email and managed to leak AWS keys. In every case, the core trick is the same: the machine reads something the person cannot see.
What the spam campaign did instead
Microsoft built a security signature to hunt for Tag characters in email. The signature was designed for the AI attack scenario, expecting to catch hidden instructions. When alerts spiked, the security team pulled a sample and found no hidden instructions at all. Instead, the invisible characters were sitting inside ordinary words.
One Tag space was inserted into the middle of a finance-related term. So 'funding' traveled as 'fun,' then an invisible character, then 'ding.' A traditional keyword filter matching the literal string 'funding' would not detect it. That is a small prize on its own, because modern spam classifiers do not rely on simple keywords. They run on machine learning models that split text into tokens before reasoning about it. Insert one invisible character, and a familiar token can become two unfamiliar fragments or a rare sub-token the model has barely seen. Microsoft described the intent as inverted but the mechanism as similar, and noted that a user's suspicions are not raised because the rendered message looks completely normal.
The campaign did not work
The scale of the campaign obscures one critical fact: the evasion failed. According to Microsoft, more than 99% of the messages were caught by layers that had nothing to do with the invisible characters. Sender and IP reputation checks, URL and domain verification, brand impersonation detection, email authentication, and the machine-learning classifiers themselves all fired. Microsoft Defender also took photographs of message content and read the text back with OCR, which sees what a human sees. That effectively removed the advantage of the hidden characters.
There is a second problem for the attacker. Tag characters are so rare in ordinary email that using them is itself a beacon. Microsoft says their presence is now a high-confidence indicator of malicious or suspicious mail. What was intended as an evasion technique has become a detection signal.
The first version of Microsoft's signature had exactly one notable false-positive problem, and it was a benign one. The signature kept firing on legitimate messages that contained the flags of England, Scotland, and Wales. Those emoji flags are built from invisible Tag characters, so the detection had to be tuned to avoid flagging ordinary national flag emoji.
The numbers and timeline
The campaign showed a clear machine-driven rhythm. On 8 February, the signature fired on roughly 21,000 messages. The next day, it fired on more than 1.3 million. For about three months, weekday volumes ran between 1 million and 2.37 million messages. Traffic collapsed to near zero every Sunday and spiked again on Monday. That pattern is typical of scheduled bulk-sending infrastructure rather than individual human behavior. Volumes fell about 80% per weekday by late March, dropped sharply after 15 May, and left a residual trickle into mid-June.
Microsoft's own blog post contains two different peak dates. A chart caption puts the high above 2.3 million messages on 11 February. The text in a later section says the peak was 26 February. Other media reports at the time described detections reaching 2.5 million within four days of the campaign's onset, which matches neither figure. The overall shape of the campaign is not in doubt, but the exact highest day is hard to pin down from the published numbers.
Fake domains from a tiny vocabulary
The mail came from about 150 disposable, finance-themed sender domains. On 9 February alone, Microsoft observed 148 distinct domains. They were assembled from a vocabulary of just 28 words: advance, boost, business, capital, catalyst, choice, digital, direct, elevate, express, finance, funding, growth, guardian, harbor, loan, loans, loc, online, our, pulse, rocket, rush, the, united, wave, way, and your. Recombining those words produced names like guardiangrowthfunding, digitalcapitalboost, advancefundingboost, and 145 more. The busiest domain received 30,442 hits in a single day.
None of those domains actually sent the emails directly. The campaign relayed messages through ActiveCampaign, a legitimate marketing platform, which rewrites every link to route through its own tracking domains. About 92% of the total volume came from a single network block belonging to that platform. Borrowing a trusted platform's reputation is now standard practice in both phishing and spam operations. Google sued a Chinese operation in June that used Gemini to build phishing sites and send 2.5 million scam texts. Volume is cheap; trusted infrastructure is scarce.
ActiveCampaign told Microsoft that it had tested the obfuscation technique against its own moderation systems. Obfuscated messages received the same verdicts as clean ones, the company said. ActiveCampaign also said it treats heavy use of invisible characters as a suspicious signal in its own right.
A broader operation
The Unicode phase was one chapter of something longer. Fortra documented the wider operation in September 2025, when it was using the same ActiveCampaign platform to send AI-generated phishing aimed at Small Business Administration loan applicants. That campaign ran before the Tag characters appeared and continued after they stopped. The invisible-character spam appears to have been an experiment grafted onto an existing abuse pipeline.
Normalize before you match
Microsoft's advice for defenders is straightforward: strip or fold invisible code points out of subject and body text before any keyword, signature, or regular expression logic looks at them. The same control cuts both ways. Cleaning Tag characters out of email before a filter sees them also cleans them out before an AI assistant reads an inbox. OpenAI took a blunter route in June by giving ChatGPT a Lockdown Mode designed to mitigate the same general class of hidden-instruction attacks.
The crossover is the lesson from this episode. Techniques do not stay in the domain that made them famous. ASCII smuggling took about a year to travel from red-team write-ups to bulk email spam, and when it arrived, it arrived without the part that made it interesting. But the fact that attackers are willing to borrow obscure Unicode tricks from AI research is a reminder that security defenses must be built to handle abuse methods that migrate across very different threat landscapes.
Source:TNW | Data-security News