ASCII smuggling, a technique originally used for stealthy AI prompt injection attacks, has been widely adopted by spammers to evade email filtering systems. Microsoft Defender for Office detected a dramatic surge in early 2025, spiking from roughly 21,000 daily detections to over 2.5 million within days, before tapering off by mid-May.
Background
ASCII smuggling exploits a block of 128 private-use Unicode characters (U+E000–U+E07F) that are invisible to humans but readable by computers, making them ideal for hiding malicious content from both human readers and keyword-based filters.
- Source
- Ars Technica
- Published
- Sep 5, 2026 at 01:18 AM
- Score
- 7.0 / 10