Spammers exploit invisible AI hacking trick to split keywords in emails

Researchers Noam Kochavi and Sarah Wolstencroft from Microsoft Security Research have discovered a large-scale spam campaign utilizing invisible Unicode characters to obscure financial lure terms. This technique, known as "ASCII smuggling," was originally used in AI security research to hide instructions inside text, but has now been adopted by spammers for the far simpler task of splitting the word "funding."

The method exploits the Unicode Tags block (U+E0000 to U+E007F), which contains invisible mirrors of printable ASCII characters. By inserting an invisible tag character into the middle of "funding," making it "fun" followed by the invisible character and then "ding," the recipient still reads the complete word. However, keyword filters and modern machine learning-based classifiers, which split text into tokens, are fooled by the unfamiliar sub-tokens.

Despite the scale of the campaign, the evasion attempt failed. Microsoft reported that more than 99% of the spam messages were blocked by other security layers, such as sender and IP reputation, URL and domain checks, brand impersonation detection, and Windows Defender's OCR, which reads the text as a human would see it. Furthermore, because these tag characters are extremely rare in legitimate emails, their presence has become a high-confidence indicator for detection rather than evasion.

At its peak, the campaign pushed between 1 and 2.37 million messages per weekday, using approximately 150 disposable finance-themed domains and relaying them through the ActiveCampaign platform. Microsoft recommends that security systems strip or fold invisible code points out of subject lines and body text before any keyword, signature, or regex logic processes them.