Microsoft Security Blog reported on September 3, 2026, that a technique associated with AI prompt injection is crossing into traditional phishing evasion. The emails Microsoft studied were not hiding instructions for an AI assistant. Attackers inserted invisible Unicode tag characters into financial lure words so that the string seen by a filter was no longer intact.
ASCII smuggling commonly uses the Unicode Tags block from U+E0000 through U+E007F. These code points usually do not render in ordinary fonts and interfaces, but remain in the underlying text and can be processed by a language model or other parsing software. Microsoft uses U+E0041 for A and U+E0061 for a as examples. The core problem is the gap between what a person sees and what a model or filter receives.
In AI-security research, the familiar pattern is to hide instructions in a web page, document, or email so a human sees nothing unusual while an AI assistant receives the hidden text. The observed phishing campaign reversed that purpose. A word such as funding could be transmitted as fun, an invisible character, and ding. It still looked normal to the recipient, but a literal match or unnormalized signature no longer saw the contiguous keyword.
The detection work started as Microsoft Defender for Office 365 research into email-borne prompt injection. The first signature flagged any code point in the tag block, but it also caught the England, Scotland, and Wales subdivision flag emojis, which legitimately use tag characters. Microsoft had to exclude those cases and combine the remaining signal with sender, domain, URL, and behavioral evidence.
Microsoft telemetry showed a sharp increase in signature hits on February 9, 2026, with more than 2.3 million messages on February 11. The researchers clustered the activity into roughly 150 finance-themed sender domains and saw a strict weekday-on, weekend-off rhythm. The specific tag-character phase fell sharply after May 15 and left a lower residual into mid-June. Those dates describe one observed campaign phase, not the complete lifetime of the wider phishing operation.
Microsoft also says most messages were flagged by layered protections rather than by a Unicode-only signal. More than 99% were caught through combinations of sender, IP, URL, and domain reputation, ML phishing classification, brand-impersonation detection, authentication, and other controls. ASCII smuggling exposes a possible detection gap, but it does not prove that every filtering stack is bypassed in the same way.
The defensive principle is normalize before you match. Strip or fold Unicode tag characters and other invisible code points before applying keyword, signature, or regex checks. Treat the tag block as an anomaly signal, then corroborate it with finance-themed domains, bulk behavior, and sending infrastructure. The same normalization should happen before email content is ingested by an AI system so hidden instructions are less likely to enter an assistant’s context.
The broader lesson is that AI-security techniques do not stay inside AI products. When prompt-injection text manipulation is reused for phishing, defenders need to understand Unicode, tokenization, email filtering, ML classifiers, and agent ingestion together. The durable response is not one magical signature. It is a layered pipeline combining normalization, OCR, reputation, authentication, prompt-injection protection, and human investigation.
