ASCII smuggling jumped from AI prompt injection to a 2.3M-message-per-day phishing campaign
Microsoft published a teardown on September 3 of a campaign that abused the Unicode Tags block (U+E0000-U+E007F), specifically TAG SPACE U+E0020, to split financial keywords ('fun[U+E0020]ding') so literal signatures miss them and ML tokenizers stop seeing familiar units. Volume went from about 21,000 messages to over 1.3 million on February 9, peaked at 2.3 million on February 11, ran weekdays-only for roughly three months, and stopped after May 15, across about 150 finance-themed sender domains routed through ActiveCampaign for authentication reputation. Microsoft's guidance for anyone piping email into an assistant: strip or normalize U+E0000-U+E007F from subject and body before applying content signatures and before AI ingestion, and treat tag-block presence as an anomaly signal.
↳ Follow the thread