\n<\/p>\n
Experts warn that cybercriminals are now using a method called \u201cASCII smuggling\u201d to help phishing emails get past security filters and reach people\u2019s inboxes.<\/strong><\/p>\n ASCII is a system that changes letters and words into numbers so computers can understand them. It can also create characters that do not appear on the screen, making them invisible to people yet still readable by computers.<\/span><\/p>\n A new report from Microsoft security researchers shows that criminals are exploiting this to send phishing emails. Most email providers use filters to catch spam by looking for keywords like \u201cfunding,\u201d \u201ccredit,\u201d or \u201cloan,\u201d and then move those emails to the spam folder.<\/span><\/p>\n Attackers add invisible characters into these keywords, breaking them up and confusing the filters.<\/span><\/p>\n People see the word \u201cfunding\u201d in their email, but the security system sees something like \u201cfun[a long string of characters]ding.\u201d This method comes from prompt injection attacks, where criminals use ASCII smuggling to send hidden, harmful prompts in emails.<\/span><\/p>\n So, if someone asks their AI assistant to summarize the email, the assistant might follow a hidden prompt that could steal sensitive information or install malware.<\/span><\/p>\n Microsoft reports that this campaign has been running for months. It reached its peak in February 2026, with over 2.3 million emails sent each day, and although the numbers have since dropped, the threat remains active. In early February, Microsoft identified nearly 150 finance-focused sender domains, accounting for 96% of the spam emails flagged for ASCII smuggling by Defender for Office 365.<\/span><\/p>\n