Microsoft built a prompt injection detector. Then it caught a phishing campaign instead.
The New Stack Amanda Caswell
Microsoft found a phishing wave hiding words with invisible Unicode characters. The trick beats filters now, and it could also fool AI systems that read outside text.
Based on reporting by The New Stack, Amanda Caswell — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Microsoft says last week’s phishing campaign used a neat little trick with ugly implications: invisible Unicode tag characters slipped into email body text, changing what software saw without changing what people saw. The messages looked normal on screen. Under the hood, though, the text had been altered in a way that could dodge spam filters and machine-learning classifiers.
The bait was financial. Attackers tucked the characters into words like “funding,” “loan,” and “credit,” so exact-match filters would miss them. In Microsoft Defender for Office 365, a hunting signature tied to this kind of Unicode abuse lit up on roughly 21,000 messages the day before the campaign began. The next day, it jumped to more than 1.3 million. Two days later, it had passed 2.3 million.
Researchers have already seen a similar method aimed at LLMs, often called ASCII Smuggling. The idea is the same: use code points in the U+E0000 to U+E007F range that sit in the text stream but don’t show up in most interfaces. Humans read one thing. Software processes another. That split is exactly what makes the trick useful.
Microsoft’s case was not about hiding secret instructions inside an AI model. It was simpler, and maybe more annoying: make phishing text look ordinary to people while breaking the keyword checks standing in its way. That matters because AI systems and agent pipelines often ingest text from outside sources with less of the extra protection email systems have built up over years.
The fix sounds straightforward, but only up to a point. If an application has no reason to accept these tag characters, Microsoft says to strip them before the text reaches the model. If the characters are legitimate, developers need to compare the original text with a cleaned version, test the tokenizer they actually use, and keep the cleaned text cleaned all the way through the pipeline. There’s also one sharp edge: the invisible tags are used for subdivision flag emojis for England, Scotland and Wales, so Microsoft’s first hunt had to be narrowed after it accidentally caught those too.
My take — AI-written commentary, not fact-checked reporting
This is the part of AI that keeps getting ignored: the dumb old text layer still runs the show. Fancy models don’t matter much if a hidden Unicode character can knock the legs out from under the pipeline. Anyone shipping AI systems without brutal text normalization is basically leaving the side door open and hoping nobody notices the lock is decorative.
Read more about this at: The New Stack
