A Phishing Campaign Repurposed an AI Prompt-Injection Trick to Hit 2.37 Million Emails a Day

Microsoft says attackers have taken a technique built to hide instructions from AI models and repurposed it for one of the oldest tricks in security: sneaking phishing keywords past a spam filter. In a blog post published September 3, Microsoft security researchers Noam Kochavi and Sarah Wolstencroft describe a high-volume financial-lure phishing campaign that used invisible Unicode characters to split up filter-trigger words, at a peak of more than 2.37 million messages in a single day.

Hiding a word inside itself

The technique is called ASCII smuggling, and until now it has mostly shown up in research on indirect prompt injection, where an attacker hides instructions inside a webpage or document using Unicode characters that render as nothing to a human reader but are still legible to an AI model that processes the raw text. Microsoft’s team was specifically hunting for that AI-focused abuse pattern in Defender for Office 365 telemetry when they noticed a spike in a signature built to catch it.

What they found instead had nothing to do with AI. According to The Register, which reviewed Microsoft’s write-up, Kochavi and Wolstencroft said: “When we looked at a sampling of the flagged messages, the surprise was there were no smuggled instructions to an AI assistant. Instead, the invisible tag characters were inserted inside common financial keywords, splitting them apart so that a literal signature or keyword match would fail.” A word like “funding” became “fun[invisible character]ding,” with a TAG SPACE character (U+E0020) from the Unicode Tags block (U+E0000 to U+E007F) sitting between the two halves. To a person reading the email, and to most simple keyword filters, the word never appears at all.

A campaign built for volume, not subtlety

The scale is what got Microsoft’s attention. Hits on the company’s ASCII-smuggling detection signature ran at a baseline of around 21,000 messages on February 8, 2026, before jumping to more than 1.3 million the next day, according to BleepingComputer. That same day, Microsoft traced the surge to a cluster of 148 finance-themed sender domains responsible for roughly 96% of the flagged mail. Volumes stayed in the 1 to 2.37 million range on weekdays for about three months, peaking on February 26, before stepping down by roughly 80% by late March and dropping sharply after May 15. Its use then tapered into lower, intermittent activity that continued through mid-June.

The campaign’s own rhythm was as telling as its size. Kochavi and Wolstencroft, quoted by The Register, described “a distinctive shape: bulk volume from churning, finance-themed disposable domains, on a strict weekday-on / weekend-off schedule,” adding that “a sudden spike of tag-block characters concentrated on finance-themed senders, switching on and off weekly, is a high-confidence campaign indicator.” The sender domains themselves were disposable, recombining a shared pool of roughly 28 words such as advance, boost, business, capital, catalyst, choice, digital, and direct into names like digitalcapitalboost[.]com, all pushing business-funding, loan, and credit lures.

Microsoft ties the underlying operation to a financial-lure phishing campaign that security firm Fortra had already identified in September 2025, months before the Unicode trick showed up. Microsoft’s own researchers were careful to draw that distinction: “The high-volume phase persisted for roughly three months after February 9 and dropped sharply after May 15, 2026,” the company said. “These dates bound the observed use of the specific technique in our telemetry, not the broader campaign, which started earlier without it and continued without it.” In other words, the operators did not shut down; they appear to have moved away from this particular evasion method.

Legitimate infrastructure did the delivering

The messages were not sent from throwaway infrastructure the attackers built themselves. Instead, according to SC Media, about 98.5% of the flagged mail carried an envelope pattern consistent with the shared sending pool used by ActiveCampaign, a legitimate email marketing platform, and roughly 92% originated from a single network block, 173.236.20[.]0/24. Click-tracking links were routed through ActiveCampaign’s own link-rewriting infrastructure at activehosted[.]com and acemlnd[.]com.

Microsoft published a statement from ActiveCampaign alongside its findings: “We take abuse, fraud, and security extremely seriously. We tested the specific technique described in this research against our content-moderation systems: messages containing invisible Unicode characters receive the same moderation verdicts as their unobfuscated equivalents, and heavy use of the technique is itself treated as a suspicious signal. We continually invest in improving our detection and prevention capabilities, including expanding our use of AI and machine learning to identify abusive sending behavior earlier in the account lifecycle.” Microsoft noted that these infrastructure fingerprints are tied to a legitimate platform rather than a specific threat actor, so they work best as corroborating signals rather than standalone proof of abuse.

Why the crossover matters

Despite the technique’s scale, Microsoft says its layered defenses, including sender reputation, authentication checks, and machine-learning detection, still caught more than 99% of the flagged messages on other signals. The Unicode trick mainly defeated the narrowest kind of defense: literal keyword and signature matching. That is exactly why Kochavi and Wolstencroft frame the finding as a warning rather than a one-off curiosity. “As AI-era attack methods become better understood, threat actors may adapt them for use in more traditional threats such as phishing and spam,” they wrote, according to The Register. “This case illustrates how techniques that emerge in AI security research can quickly cross over into established attack ecosystems, reinforcing the need for defenders to view emerging threats through a cross-domain lens.”

The same trick cuts both ways for AI-based defenses, too. Splitting a keyword with an invisible character can confuse the tokenizer inside an LLM-based email scanner before the model ever gets a chance to reason about the combined word, the same fundamental weakness that makes ASCII smuggling useful against AI assistants in the first place. Organizations building AI agents that read untrusted email or web content face a related exposure; sxz.io has previously covered how to add guardrails against prompt injection in a Python AI agent.

What Microsoft recommends

Microsoft’s core advice is to normalize before matching. Any content that will be evaluated by keyword, signature, or regex logic should first have Unicode tag-block characters (U+E0000 to U+E007F) and other invisible or zero-width code points, such as the zero-width space (U+200B) or no-break space (U+00A0), stripped or folded out, so that splicing an invisible character into a word can no longer defeat the match. Because the tag block’s only common legitimate use is encoding a handful of regional flag emoji, such as England, Scotland, and Wales, Microsoft says its presence anywhere else in email content is itself a high-confidence signal of abuse. The company recommends applying that same normalization step upstream of any AI-based content analysis, or falling back on optical character recognition of a rendered image of the message, which is not affected by hidden characters in the underlying text at all. On the behavioral side, defenders are pointed toward the campaign’s own fingerprint: bulk volume from churning, finance-themed, disposable sender domains, arriving on a strict weekday schedule that goes quiet on weekends.