Microsoft Warns ASCII Smuggling Is Being Used to Hide Phishing Keywords From Email Filters

Researchers observed a high-volume phishing campaign that inserted invisible Unicode tag characters into financial terms such as “funding,” “loan,” and “credit.” To recipients, the messages looked normal.

However, the hidden characters split the words at the processing level, potentially preventing simple keyword-based filters from recognizing suspicious language.

For example, the visible word “funding” could contain an invisible Unicode character between “fun” and “ding.” A user would still read the complete word, but a detection tool looking for the exact text string “funding” may fail to match it.

ASCII smuggling is the use of non-rendering Unicode characters to conceal text inside apparently normal content.

The technique commonly abuses the Unicode Tags block, ranging from U+E0000 to U+E007F. These characters are largely invisible in standard fonts and email applications.