Microsoft Threat Intelligence describes a phishing campaign that moves a technique known from AI security research into conventional email attacks: ASCII smuggling. The attackers inserted invisible Unicode tag characters into words such as “funding” so filters or tokenizers no longer saw one clean string. Microsoft also gives concrete detection and protection guidance for Microsoft Defender for Office 365.
What Microsoft reported on 3 September 2026
The Microsoft Security Blog reports a high-volume, finance-themed phishing campaign. The messages used invisible characters from the Unicode Tags block U+E0000 through U+E007F, especially U+E0020. Recipients still saw readable text, but the technical content split high-signal words into fragments. Microsoft gives the example “fun<U+E0020>ding” instead of “funding”.
Microsoft does not describe this as full hidden-message smuggling. The operational point is the reused character class: what prompt-injection attacks use to make people and AI models read different content was repurposed for phishing evasion. Microsoft telemetry says the high-volume phase started on 9 February 2026 and stayed elevated on weekdays for roughly three months.
Why this matters for smaller organizations
The campaign targets ordinary email and finance lures that can work in organizations with 10 to 250 seats: credit lines, advance funding, business-loan offers, and similar requests. The practical question is whether the email protection chain normalizes invisible characters before detection logic evaluates the message.
- Phishing messages can look plausible to users even when the technical text is manipulated.
- Signatures and regular expressions can fail if they run before normalization.
- AI-based classifiers can see different token boundaries than the human recipient sees.
- Shared marketing infrastructure can make reputation-based decisions harder.
Urgency: no deadline, but active review required
Microsoft does not publish a migration deadline. The concrete action is a timely control and hunting review. The blog describes a jump from roughly 21,000 signature hits on 8 February to more than 1.3 million on 9 February 2026, with a peak above 2.3 million messages on 11 February. The high-volume phase dropped sharply after 15 May, but the broader campaign continued to adapt.
For environments using Microsoft Defender, the important point is layered resilience. Microsoft states that Defender for Office 365 flagged over 99 percent of messages through layers that did not depend only on catching Unicode characters, including sender, IP, URL, and domain reputation, ML phishing classification, brand-impersonation detection, authentication checks, and OCR-based content analysis.
Which signals Defender can surface
Microsoft lists Unicode tag characters as the primary content pattern, but explains why the Advanced Hunting examples use infrastructure fingerprints instead: the email body is not exposed through the relevant table columns. The hunting pivots therefore focus on finance-themed sender domains, envelope sender shapes, tracking links on ActiveCampaign domains, and timing patterns. They are starting points, not standalone verdicts.
- Treat Unicode tag characters in the subject or body as a strong anomaly signal.
- Account for legitimate exceptions such as England, Scotland, and Wales flag emojis instead of blocking every tag sequence blindly.
- Correlate finance-themed disposable domains assembled from repeated word tokens.
- Use tracking domains such as activehosted.com or acemlnd.com only as corroboration because legitimate senders use them too.
- Use the 173.236.20.0/24 block only for scoping, not as an independent blocking indicator.
Concrete next steps
Administrators should verify whether their mail filtering pipeline strips or folds invisible and non-rendering Unicode code points before keyword, signature, or regex checks run. Microsoft summarizes the principle clearly: “normalize before you match.” The same normalization should happen before email content is passed to AI assistants or automations, so prompt-injection and phishing evasion are not treated separately.
It is also worth reviewing Threat Explorer, real-time detections, and Advanced Hunting for Microsoft’s patterns. Microsoft Learn describes Defender for Office 365 Prompt Injection Protection as mail-flow detection before the message reaches the user or an AI assistant. Matching messages appear under the “High confidence phishing” verdict with the detection technology “Prompt injection protection.” In a Microsoft Security Assessment, this becomes a test case: does the message become visible before delivery, at click time, through reputation, or only through later correlation?
Official Microsoft sources
- Microsoft Security Blog: ASCII smuggling crosses over from AI prompt injection to phishing evasion
- Microsoft Learn: Prompt injection protection in Microsoft Defender for Office 365
- Microsoft Learn: Microsoft Defender for Office 365 documentation
If you want to know whether your Microsoft 365 email security detects this kind of Unicode manipulation, and whether email content is normalized cleanly before AI workflows process it, get in touch.
What does this mean for your environment?
Assess the topic in the context of your Microsoft 365 environment and define a practical next step.
You speak directly with Sebastian Kerssen – working in the Microsoft ecosystem since 2014, with personal consulting and a dedicated point of contact.
