ASCII smuggling crosses over from AI prompt injection to phishing evasion
Microsoft details high-volume phishing campaign using ASCII smuggling (Unicode tag chars) for filter evasion, peaking at 2.3M messages.
Microsoft researchers observed a high-volume finance-themed phishing campaign using invisible Unicode tag characters (U+E0000–U+E007F), a technique known from AI prompt injection research as ASCII smuggling, to split lure words like 'funding' and evade email filters. Telemetry from Microsoft Defender for Office 365 showed signature hits jump from roughly 21,000 messages on February 8, 2026 to more than 1.3 million on February 9, peaking above 2.3 million on February 11, with elevated weekday activity lasting approximately three months. The discovery emerged from prompt injection protection research, showing AI-era evasion techniques crossing into traditional phishing. Most messages were flagged by layered Defender protections rather than a single Unicode-specific signal.
- Phishing campaign used invisible Unicode tag characters to obfuscate financial lure keywords from filters.
- ASCII smuggling technique originated in AI prompt injection/XPIE research and was repurposed for phishing evasion.
- Signature hits rose ~two orders of magnitude from ~21,000 to 1.3M messages on Feb 9, 2026, peaking at 2.3M.
- Activity remained elevated on weekdays for approximately three months.
- Detection was discovered via Defender for Office 365 prompt injection hunting logic.
- Tags
- ascii-smugglingdefender-for-office-365email-securityevasionmicrosoftphishingprompt-injectionunicode
- Vendors
- Microsoft
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | acemlnd.com | ssage body to route through its own click-tracking domains (acemlnd[.]com and activehosted[.]com), so the URLs the recipient clicks |
| domain | acems10.com | aped acems<N>[.]com and emsd<N>[.]com (e.g. emsd4[.]com, s9.acems10[.]com). Across the measured activity, ~98.5% of messages matche |
| domain | activehosted.com | e through its own click-tracking domains (acemlnd[.]com and activehosted[.]com), so the URLs the recipient clicks do not point at the br |
| domain | advancefundingboost.com | usinessloanexpress[.]com 25,048 yourlocfunding[.]com 24,482 advancefundingboost[.]com 24,053 guardiancapitalway[.]com 23,921 harboradvancefundi |
| domain | catalystboostfunding.com | rbusinessloans[.]com 20,444 directcapitalpulse[.]com 19,767 catalystboostfunding[.]com 19,519 elevatecapitalrush[.]com 19,395 fundingexpresscapi |
| domain | catalystcapitalharbor.com | tcapitalboost[.]com 22,875 onlinedirectfinance[.]com 21,195 catalystcapitalharbor[.]com 21,130 rocketboostfunding[.]com 20,908 digitalrushcapital |
| domain | digitalcapitalboost.com | omain Hits (Feb 9, 2026) guardiangrowthfunding[.]com 30,442 digitalcapitalboost[.]com 27,021 thebusinessloanexpress[.]com 25,048 yourlocfunding |
| domain | digitalrushcapital.com | tcapitalharbor[.]com 21,130 rocketboostfunding[.]com 20,908 digitalrushcapital[.]com 20,796 guardianloccapital[.]com 20,781 guardianlocchoice[ |
| domain | directcapitalboost.com | radvancefunding[.]com 23,595 unitedfundingwave[.]com 23,269 directcapitalboost[.]com 22,875 onlinedirectfinance[.]com 21,195 catalystcapitalha |
| domain | directcapitalpulse.com | uardianlocchoice[.]com 20,553 ourbusinessloans[.]com 20,444 directcapitalpulse[.]com 19,767 catalystboostfunding[.]com 19,519 elevatecapitalru |
| domain | elevatecapitalrush.com | capitalpulse[.]com 19,767 catalystboostfunding[.]com 19,519 elevatecapitalrush[.]com 19,395 fundingexpresscapital[.]com 18,695 Table 1. Top 20 |
| domain | emsd4.com | ending pool , shaped acems<N>[.]com and emsd<N>[.]com (e.g. emsd4[.]com, s9.acems10[.]com). Across the measured activity, ~98.5% |
| domain | fundingexpresscapital.com | stboostfunding[.]com 19,519 elevatecapitalrush[.]com 19,395 fundingexpresscapital[.]com 18,695 Table 1. Top 20 (by signature hits) of the 148 fin |
| domain | guardiancapitalway.com | ourlocfunding[.]com 24,482 advancefundingboost[.]com 24,053 guardiancapitalway[.]com 23,921 harboradvancefunding[.]com 23,595 unitedfundingwav |
| domain | guardiangrowthfunding.com | and the per-domain volume: Sender domain Hits (Feb 9, 2026) guardiangrowthfunding[.]com 30,442 digitalcapitalboost[.]com 27,021 thebusinessloanex |
| domain | guardianloccapital.com | etboostfunding[.]com 20,908 digitalrushcapital[.]com 20,796 guardianloccapital[.]com 20,781 guardianlocchoice[.]com 20,553 ourbusinessloans[.] |
| domain | guardianlocchoice.com | talrushcapital[.]com 20,796 guardianloccapital[.]com 20,781 guardianlocchoice[.]com 20,553 ourbusinessloans[.]com 20,444 directcapitalpulse[. |
| domain | harboradvancefunding.com | cefundingboost[.]com 24,053 guardiancapitalway[.]com 23,921 harboradvancefunding[.]com 23,595 unitedfundingwave[.]com 23,269 directcapitalboost[ |
| domain | onlinedirectfinance.com | tedfundingwave[.]com 23,269 directcapitalboost[.]com 22,875 onlinedirectfinance[.]com 21,195 catalystcapitalharbor[.]com 21,130 rocketboostfund |
| domain | ourbusinessloans.com | rdianloccapital[.]com 20,781 guardianlocchoice[.]com 20,553 ourbusinessloans[.]com 20,444 directcapitalpulse[.]com 19,767 catalystboostfundi |
| domain | rocketboostfunding.com | rectfinance[.]com 21,195 catalystcapitalharbor[.]com 21,130 rocketboostfunding[.]com 20,908 digitalrushcapital[.]com 20,796 guardianloccapital |
| domain | thebusinessloanexpress.com | growthfunding[.]com 30,442 digitalcapitalboost[.]com 27,021 thebusinessloanexpress[.]com 25,048 yourlocfunding[.]com 24,482 advancefundingboost[.] |
| domain | unitedfundingwave.com | ancapitalway[.]com 23,921 harboradvancefunding[.]com 23,595 unitedfundingwave[.]com 23,269 directcapitalboost[.]com 22,875 onlinedirectfinanc |
| domain | yourlocfunding.com | pitalboost[.]com 27,021 thebusinessloanexpress[.]com 25,048 yourlocfunding[.]com 24,482 advancefundingboost[.]com 24,053 guardiancapitalwa |
| url | https://＜account-id＞.acemlnd.com/＜tracking-token＞ | s do not point at the brand domain at all – they look like: hxxps://＜account-id＞.acemlnd[.]com/＜tracking-token＞ hxxps://＜brand-subdomain＞.activehosted[.]com/＜tracking-to |
| url | https://＜brand-subdomain＞.activehosted.com/＜tracking-token＞ | k like: hxxps://＜account-id＞.acemlnd[.]com/＜tracking-token＞ hxxps://＜brand-subdomain＞.activehosted[.]com/＜tracking-token＞ Most of the flagged messages carried links associated wit |
From the original article
13 min read at microsoft.com
Invisible Unicode characters popularized for hiding instructions from AI models are now being used to obfuscate words before email filters parse them. The post ASCII smuggling crosses over from AI prompt injection to phishing evasion appeared first on Microsoft Security Blog.
By Microsoft Security Research, Noam Kochavi and Sarah Wolstencroft · microsoft.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.