Summary
- Microsoft observed attackers inserting invisible Unicode tag characters into phishing lure words to interfere with filtering and tokenisation.
- The observed technique peaked at more than two million messages a day in Microsoft telemetry.
- A mechanism associated with AI prompt injection has crossed into conventional email evasion without the messages themselves targeting AI systems.
Microsoft researchers have identified a high-volume phishing campaign using invisible Unicode characters popularised by AI prompt-injection research to interfere with conventional email filtering.
The technique uses code points from the Unicode Tags block, U+E0000 to U+E007F, a range containing characters that generally do not render visibly to a user. The same property has attracted attention in AI security because hidden content can remain present in the text processed by software even when it is invisible on screen.
Microsoft’s latest research found attackers using the mechanism differently. Instead of hiding instructions for an AI assistant, they inserted individual invisible tag characters into financial lure words so that the text appeared normal to a person while its underlying character sequence was altered.
A word such as “funding”, for example, could contain an invisible tag-space character between visible letters. A person still sees the expected word, but a simple signature or downstream tokenisation process may receive a different sequence.
The campaign was discovered through hunting logic Microsoft had originally developed to identify prompt injection and content obfuscation in email. Signature hits rose sharply on 9 February and remained elevated on weekdays for roughly three months before the high-volume phase fell away after 15 May.
The scale was substantial. Microsoft’s telemetry recorded more than 1.3 million hits on 9 February, rising above 2.3 million messages on 11 February. During the high-volume period, weekday traffic generally ranged between one million and 2.37 million messages.
The campaign used finance-themed lures and rotating sender domains and was associated with a legitimate email-marketing platform abused for delivery. Microsoft linked the activity to a broader campaign that had begun before use of the Unicode technique and continued after the technique declined.
The crossover is notable because it shows how an evasion mechanism made prominent by AI security research can migrate into conventional attack infrastructure. Invisible-character manipulation itself is not new — attackers have long used zero-width characters, homoglyphs, and related text tricks — but Microsoft says the Unicode Tags range has become particularly visible through prompt-injection research.
Once a technique is widely documented, the distinction between the research area in which it became prominent and the attack environment in which it is useful can disappear quickly. The underlying mechanism can interfere with keyword detection, spam classification, or other text-processing systems without an AI assistant ever being involved in the attack.
Microsoft also found that the unusual characters can become a defensive signal. Unicode Tags are rare in normal email, although legitimate uses include the encoding of the England, Scotland, and Wales subdivision flag emoji.
That introduces an engineering question around text normalisation. Email can pass through MIME parsing, HTML handling, character conversion, optical character recognition, tokenisation, machine-learning models, and AI analysis. Differences between what those layers consider equivalent visible text can create gaps.
Microsoft said more than 99% of messages in the observed campaign were caught by protection layers that did not depend solely on recognising the Unicode characters, including reputation, machine-learning, authentication, and impersonation controls. The finding therefore does not amount to evidence that the technique broadly defeats Microsoft Defender.
Instead, it shows that emerging evasion methods can cross security domains quickly. A mechanism made familiar through AI red-teaming became useful in bulk phishing because both environments depend on differences between what humans see and what software processes.
Microsoft says Defender for Office 365 has heuristic detections for the behaviour and continues to track the associated sender infrastructure. The wider technical question is whether other email-processing pipelines consistently normalise the same class of invisible characters before applying their own detection logic.
