Microsoft: ASCII smuggling now used in real-world phishing evasion
wunderwuzzi23 · x · 2026-09-06
Microsoft security researchers report that ASCII smuggling—long an AI prompt injection technique—has crossed over into real-world phishing. While hunting for prompt injection activity, the team uncovered a high-volume finance-themed phishing campaign where attackers inserted invisible ASCII characters into keywords to evade email security filters.
- Technique originates in AI security: hiding malicious instructions via invisible Unicode characters
- Now repurposed by traditional phishers as an evasion trick
- Microsoft Defender teams have published detection and mitigation guidance
- Full analysis in the Sept 3 Microsoft Security Blog post
More from Safety
- India needs an "AI defence force": experts warn of agent swarms and AI worms — ravi_iitm · 2026-10-23
- DeepSeek US ban covers self-hosted weights, not just the app — AIFlow_ML · 2026-10-23
- Uncensored fine-tunes vanish from Hugging Face amid unexplained takedowns — umarmnaq · 2026-10-23
- Gmail's AI scans your emails and attachments by default; here's how to turn it off — alifcoder · 2026-10-23
- Typosquatted Blender MCP Repo Hit 958 Stars in Days and Silently Ran Malware — Promptmethus · 2026-10-23
- Prompt injection scanners should be positional, not phrasal: same string, different blast radius — mrpkk · 2026-10-23