An email can display perfectly ordinary words on screen while containing invisible characters capable of disrupting certain anti-phishing filters.
Microsoft identified this method while researching ways to protect its email service against attacks targeting artificial intelligence systems. Starting on February 9, 2026, its tools suddenly detected more than 1.3 million affected messages in a single day. The volume then exceeded 2.3 million on some days before dropping sharply in mid-May.
Illustrative image
Pixabay
To understand the trick, it is important to distinguish between what the recipient sees and what the computer reads. Digital text contains more than just visible letters. The Unicode standard also includes many special characters. Some produce virtually nothing on screen but remain present in the message data.
The campaign's authors inserted these characters in the middle of words related to financial offers. The recipient could therefore read a word such as “funding” normally. For software, however, the same word could be split into several pieces separated by an invisible character.
This difference can hinder simpler protections. A filter searching for an exact suspicious word may no longer find the same sequence of characters. Systems using machine learning can also be disrupted, as they often begin by splitting text into small elements before analyzing it.
The method is known as “ASCII smuggling.” Here, it relies on a particular area of Unicode containing invisible versions of common characters. It had mainly attracted attention in research on attacks against assistants using artificial intelligence. Instructions could then be hidden from human eyes while remaining readable by software.
The principle of discreetly breaking up words is not new in spam, however. Other invisible characters or special spaces have been used for a long time. The campaign observed by Microsoft stands out because of its choice of this family of characters.
Microsoft says that more than 99% of the messages observed were detected by other Defender mechanisms. Modern filters combine several indicators, such as the sender, links, content, and sending behavior, rather than relying on a single word.
To reduce this type of evasion, Microsoft notably recommends cleaning the text before analyzing it. Suspicious invisible characters can be removed or normalized to reconstruct the words actually displayed to the reader.