Attackers conceal phishing lures using invisible Unicode characters

Hackers are using 'invisible' Unicode characters to sneak phishing lures into emails

A technique used in prompt injection attacks has made it into phishing, Microsoft has warned.

Invisible Unicode used to bypass phishing filters

Microsoft identified a large phishing campaign using ASCII smuggling to hide finance-related lure words with Unicode tag-block characters. Telemetry showed peaks of 2.37 million emails per day in late February 2026. A cluster of 148 sender domains...

ASCII smuggling crossed over from AI attacks to spam

For two years, invisible Unicode characters have been the neat trick of AI security research. You hide instructions inside them. A person sees nothing. A language model reads them and does as it is told. Microsoft has now found somebody using the same characters for something far less clever. They were splitting up the word […] This story continues at The Next Web

Attackers conceal phishing lures using invisible Unicode characters

Threat actors have adopted the ASCII smuggling technique in phishing campaigns, using invisible Unicode characters to evade email security filters.

Cyber criminals are adapting ASCII smuggling for mass phishing campaigns

Usually known for its use in prompt injection attacks, ASCII smuggling is now being used to evade spam filters on email platforms.