Phishers Evade Spam Filters with AI-Prompt Injection Trick

Microsoft's security team has uncovered a sophisticated phishing technique that uses AI prompt-injection to evade spam filters. The researchers, Noam Kochavi and Sarah Wolstencroft, were investigating AI prompt-injection attacks when they stumbled upon something unexpected: phishers using the same invisible-character trick to sneak ordinary phishing emails past defenses.

The attackers utilized Unicode tag characters, specifically those in the range U+E0000 to U+E007F, to hide instructions inside email messages. These characters were used to split finance-themed words like 'funding' apart, breaking keyword match spam filters without altering the email's appearance to a reader.

The campaign reached its peak on February 26th with over 2.37 million daily messages using around 150 temporary finance-related sending domains. The spammers were linked to the same infrastructure previously marked by security company Fortra in September 2025 and utilized a valid software product, ActiveCampaign, to conduct spamming.

Fortunately, Microsoft claims that despite this large volume, more than 99 per cent of the emails flagged by this malware were caught by its anti-phishing protection software, Defender for Office 365. The company's fix is narrow but specific: normalizing Unicode tag characters before running any keyword or signature match and treating unexpected tag-block characters as suspicious.