Spammers adopt ASCII/Unicode tag smuggling technique from AI prompt injection attacks to evade email spam filters, Microsoft reports

Microsoft reported that spammers began embedding invisible Unicode "tag" characters (U+E0000 to U+E007F, the same block used in AI prompt injection exploits) inside trigger words like "funding" to split them and dodge both keyword filters and ML/NLP spam classifiers. Microsoft Defender for Office detections of this technique jumped from roughly 21,000/day to 1.3 million/day in early February 2026, peaking at 2.5 million within four days, then dropped sharply in mid-May 2026. Microsoft published detection guidance for developers on 3-4 September 2026, several months after the campaign had already tailed off.

Anyone running email spam filters, or any ML/NLP pipeline that classifies text (not just email), has a live blind spot: invisible characters can split or reorder tokens in ways that fool classifiers while looking normal to a human reader. This is a structural weakness in text classification generally, not an email-specific bug, so it is relevant to LLM input sanitisation, content moderation and fraud detection teams too. Practical fix is straightforward (strip or normalise the Unicode tag block before classification), which is why actionability scored reasonably despite the campaign itself being over.

The framing as a fresh discovery is overstated. Zero-width and invisible-character evasion of filters is a decades-old technique, this specific tag-block trick has circulated in the AI security community for roughly two years (credited to Riley Goodside), and the extraction itself flags this as not a new event. The spam campaign had already declined sharply by mid-May, so Microsoft's guidance is retrospective housekeeping rather than a response to an active, ongoing threat, and the alarming-sounding jump to "2.5 million detections" is a signature count, not a measure of successful attacks or reader harm.

1. 01Whether Microsoft Defender detection volumes for ASCII smuggling rise again, which would indicate the technique is being reused rather than retired.
2. 02Whether other major spam/security vendors (Google, Proofpoint, Cloudflare) confirm similar detection spikes or publish their own countermeasures.
3. 03Whether the same tag-smuggling approach shows up being used against LLM-based content moderation or fraud systems outside email, confirming the cross-domain risk.