Microsoft Warns of ASCII Smuggling Attack on Email Phishing Filters

Microsoft has issued a warning about 'ASCII smuggling', a technique used by cyber attackers to bypass email phishing filters. Researchers at Microsoft discovered a high-volume email phishing campaign in February 2026 that was using ASCII smuggling to evade detection.

The attack involved inserting invisible Unicode characters into emails to break up keywords likely to trigger signature-based defenses. The attackers specifically used the Unicode Tags block, which is commonly seen in ASCII smuggling prompt injection attacks.

The campaign peaked at 2.37 million emails on February 26 and continued through May 15, with a consistent weekly cadence that dropped sharply on weekends. Microsoft tied this campaign to a known, ongoing financial lure-themed phishing operation previously identified by Fortra in September 2025.

To combat ASCII smuggling, Microsoft recommends stripping or normalizing characters from the Unicode Tags block and other zero-width and invisible characters prior to applying content signatures.