ASCII smuggling crosses over from AI prompt injection to phishing evasion

1. Executive summary

Microsoft has documented a high-volume, finance-themed phishing campaign that repurposed "ASCII smuggling" — invisible Unicode tag characters (U+E0000–U+E007F), previously associated with AI prompt-injection research — as a filter-evasion technique against email security pipelines. Beginning 9 February 2026, hits on Microsoft's hunting signature jumped from roughly 21,000 messages on 8 February to over 1.3 million the following day, sustained at elevated weekday volume for approximately three months before dropping sharply after 15 May 2026. The mail was relayed through the legitimate ActiveCampaign email-marketing platform from roughly 150 disposable, finance-themed sender domains pushing business loan / line-of-credit / advance-funding lures — a pattern consistent with advance-fee fraud and credential-harvesting funnels. No CVE is in scope; this is a technique and campaign advisory. The bottom-line risk for EMEA financial services is twofold: direct exposure of staff to finance-lure phishing that evades keyword/ML-based mail filtering, and a demonstrated crossover of AI-era evasion techniques into traditional threat ecosystems that will recur.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The item is a technique/campaign observation with no confirmed incident at a client, no named ICT third-party provider failure, and no vulnerability requiring a specific testing or contractual response. Generic mappings to incident management or reporting would be compliance-checkbox padding; those obligations engage when a client has an actual incident, not when a technique is described in vendor telemetry.

3. Technical analysis & attack chain

Confirmed attack chain (as observed in Microsoft Defender for Office 365 telemetry)

1. Bulk registration of disposable finance-themed domains. The operator recombined a small vocabulary of finance/brand word-tokens — advance, boost, business, capital, catalyst, choice, digital, direct, elevate, express, finance, funding, growth, guardian, harbor, loan, loans, loc, online, our, pulse, rocket, rush, the, united, wave, way, your — into roughly 148–150 rotating sender domains (e.g. guardiangrowthfunding[.]com, digitalcapitalboost[.]com, thebusinessloanexpress[.]com). These are the header (P2) domains the recipient sees.
2. Relay through a legitimate marketing platform. Mail was sent through infrastructure associated with ActiveCampaign. Envelope (P1) senders took the platform's subdomain shape em-<id>.<brand-domain>. Because the mail originates from a reputable platform with established IP reputation and authentication, reputation-based filtering is complicated — the traffic resembles legitimate marketing mail.
3. Link rewriting through platform tracking domains. ActiveCampaign rewrites outbound links to route through its click-tracking domains acemlnd[.]com and activehosted[.]com, so clicked URLs do not point at the brand domain. Most flagged messages carried these tracking links rather than direct links to the sender-branded domains.
4. Invisible-character insertion in lure keywords. A single invisible Unicode tag character — the TAG SPACE, U+E0020 — was spliced inside high-signal financial keywords. The lure word "funding" is transmitted as fun⟨U+E0020⟩ding: it renders normally to the recipient but the byte sequence no longer contains the contiguous keyword. Microsoft is explicit that this is invisible-character insertion using a code point from the ASCII-smuggling tag block, not full message smuggling — no hidden ASCII message was encoded in the tag block, and no smuggled instructions to an AI assistant were present.
5. Evasion effect on detection. Literal string/regex matching fails on the fractured keyword. More significantly, ML/NLP classifiers that tokenize or sub-word-split text may no longer recognise the familiar token: the tokenizer may split "funding" into fun, an unexpected tag character, and ding, or emit rare/unknown sub-tokens. If normalisation runs first and strips U+E0020, the word reverts to "funding" — so outcomes depend entirely on each pipeline's normalisation step and its ordering relative to detection.
6. Delivery of finance-lure phishing. Lures resembled business loan, line-of-credit, and advance-funding phishing patterns often associated with advance-fee fraud and credential-harvesting funnels. This pattern accounted for roughly 96% of the volume flagged by the hunting signature; remaining hits were unrelated senders (email-security gateways, mailbox providers, researchers).

Scale and timeline. Signature hits: ~21,000 messages on 8 February 2026; >1.3 million on 9 February 2026. Elevated weekday volume persisted ~3 months, dropping sharply after 15 May 2026. Microsoft stresses these dates bound only the observed use of this specific technique — the broader campaign started earlier without it and continued after dropping it. Microsoft connected the activity to a broader ActiveCampaign-delivered, SBA-themed phishing campaign previously documented by Fortra.

Infrastructure fingerprint. The vast majority of volume originated from a single network block, 173.236.20[.]0/24 (~92% of measured activity), which is legitimate shared email-marketing-platform egress space — a scoping/corroboration signal, not a standalone block indicator. Envelope shapes observed: em-<digits>, acems<digits>, emsd<digits> (shared pool acems[.]com / emsd[.]com).

Signature tuning detail relevant to defenders building their own detection. Microsoft's first signature version flagged any code point in U+E0000–U+E007F and produced false positives on legitimate messages containing the England, Scotland, and Wales subdivision flag emojis — these are encoded as tag-character sequences (e.g. the Wales flag is base code point U+1F3F4 followed by U+E0067 U+E0062 U+E0077 U+E006C U+E0073 spelling "gbwls" and terminating tag U+E007F). Remaining baseline hits were benign artefacts from gateways, mailbox providers, and security/AI researchers. Any in-house detection must account for these exclusions.

Context and corroboration. Invisible/look-alike character insertion is a long-standing evasion family: zero-width spaces (U+200B), zero-width non-joiners, no-break space (U+00A0), soft hyphens, and homoglyphs. What is new here is the specific character range (Unicode Tags block) and the scale. Separately, Barracuda has reported over one million retail-themed phishing attacks since April using "text salting" — hidden benign text via CSS cropping, off-screen text positioning, and zero-font techniques — which similarly confuses ML/LLM-based content analysis because LLMs process text without understanding visibility. This corroborates the broader trend that AI-era and legacy obfuscation techniques are being aimed at ML-based mail classification, though the Barracuda text-salting activity is a distinct technique and campaign from the Microsoft-reported Unicode tag activity.

Confidence caveats. All campaign specifics — domain counts, volumes, the /24, the envelope shapes, the U+E0020 insertion detail — are single-sourced from Microsoft's own telemetry and research; no second vendor has independently corroborated this specific campaign. Verify before enforcement, particularly before blocking on infrastructure indicators that are shared legitimate platform space. No threat actor is named; no attribution claim exists to assess. The connection to the earlier Fortra-documented SBA-themed campaign is asserted by Microsoft but the Fortra reporting itself is not in our corpus.

MITRE ATT&CK mapping (per Microsoft): T1566 Phishing (Initial Access); T1027 Obfuscated Files or Information (Defense Evasion); AML.T0068 LLM Prompt Obfuscation (MITRE ATLAS, Defense Evasion – AI).

4. Mitigation & containment

P1 — within 24 hours

• Test your mail pipeline's Unicode handling now. Send test messages containing U+E0000–U+E007F code points (specifically U+E0020 spliced inside keywords) through your gateway and confirm whether they are normalised, flagged, or passed. Microsoft is explicit: "implementations vary, so defenders should test how these characters are handled in their own pipelines." If your stack lacks normalisation, this is the gap to close.
• Apply the core defensive principle: normalise before you match. Ensure any content evaluated by keyword, signature, or regex logic has invisible and non-rendering Unicode code points stripped or folded first, so splicing them into a word no longer defeats the match. Verify the normalisation step runs before detection, not after.
• Hunt for retrospective exposure. Run Microsoft's published KQL against the EmailEvents table (join EmailUrlInfo for URL pivots) covering at least February–May 2026:
• Infrastructure pattern: header sender domain matching ≥3 adjacent finance/brand tokens (regex vocabulary per Microsoft's kwds list) combined with envelope sender matching (?i)(em-|acems|emsd)\d; optionally scope with ipv4_is_in_range(SenderIPv4, "173.236.20.0/24") — scoping only, never a standalone filter.
• Tracking-URL pivot: finance-brand senders joined to UrlDomain endswith "activehosted.com" or UrlDomain endswith "acemlnd.com" — corroboration, not a verdict, as these domains are shared by all legitimate platform customers.
• If licensed for Defender for Office 365 Plan 2 / Microsoft 365 E5: EmailEvents | where DetectionMethods has "Prompt Injection Protection".
• Block the known campaign sender domains at your mail gateway (the 20 listed in §5 plus the remaining ~128–130 of the ~148–150 cluster; the full list is not published, so treat the sample as representative and hunt for the vocabulary pattern rather than an exhaustive blocklist). Domains rotate, so pair the blocklist with the regex pattern.

P2 — within 72 hours

• Review OCR/visual-extraction capability. Microsoft's stack takes a picture of message contents, extracts visible text via OCR, and analyses that — immune to invisible-character tricks. If your gateway or downstream LLM-based analysis ingests raw text only, it is exposed to both this technique and text salting. Raise with your email security vendor; Barracuda's reporting confirms most LLM tools do not distinguish visible from hidden text by default.
• Alert on the presence of tag-block characters as a high-confidence signal. Microsoft notes this manipulation is so rare in legitimate traffic that its presence is a low-false-positive indicator — the evasion technique is itself detectable. Implement with the flag-emoji exclusions (England, Scotland, Wales subdivision flags) and a baseline allowance for gateway/researcher artefacts.
• Warn finance, treasury, and lending-adjacent business units. The lures are business loan / line-of-credit / advance-funding offers — staff in finance functions are the target profile. Reinforce that advance-fee fraud and credential-harvesting funnels are the expected follow-on; any staff who engaged with such offers since February 2026 should be identified via the hunt above.
• Do not block 173.236.20[.]0/24, acemlnd[.]com, or activehosted[.]com outright. All are legitimate shared ActiveCampaign infrastructure also carrying unrelated legitimate mail. Blocking them will generate false positives on legitimate marketing mail; use them only as hunt scoping and corroboration.

P3 — within 7 days

• Add Unicode tag-block and hidden-text checks to mail-filter acceptance criteria and vendor assessments. Any current or prospective email security tooling (gateway, SEG, AI-based classifier) should be tested against: U+E0000–U+E007F insertion, zero-width characters (U+200B et al.), no-break space, soft hyphens, homoglyphs, and text-salting variants (CSS cropping, off-screen text, zero-font). The Barracuda text-salting reporting confirms this is a class of evasion, not a one-off.
• Extend the same normalisation discipline to any internal pipeline that ingests untrusted text into LLMs or automated processing — the identical character property enables prompt injection against AI assistants that ingest raw message content. Microsoft's prompt injection protection covers the email-borne case for MDO-licensed customers.
• Track domain rotation. Microsoft is tracking and blocking the finance-themed sending domains as they rotate; subscribe to their feed/updates if available and refresh blocklists on a recurring basis rather than one-time.

5. Indicators of compromise

All indicators below are single-sourced from Microsoft's research. The /24 and the two tracking domains are explicitly flagged by Microsoft as legitimate shared platform infrastructure — scoping/corroboration signals, not standalone block indicators.

domain  guardiangrowthfunding[.]com
domain  digitalcapitalboost[.]com
domain  thebusinessloanexpress[.]com
domain  yourlocfunding[.]com
domain  advancefundingboost[.]com
domain  guardiancapitalway[.]com
domain  harboradvancefunding[.]com
domain  unitedfundingwave[.]com
domain  directcapitalboost[.]com
domain  onlinedirectfinance[.]com
domain  catalystcapitalharbor[.]com
domain  rocketboostfunding[.]com
domain  digitalrushcapital[.]com
domain  guardianloccapital[.]com
domain  guardianlocchoice[.]com
domain  ourbusinessloans[.]com
domain  directcapitalpulse[.]com
domain  catalystboostfunding[.]com
domain  elevatecapitalrush[.]com
domain  fundingexpresscapital[.]com
ipv4  173.236.20[.]0/24
domain  acemlnd[.]com
domain  activehosted[.]com

Behavioural indicators (no atomic indicator captures the technique itself; these are observable patterns):

6. Detection

The sources provide genuine threat artefacts: the specific Unicode code point range abused, the exact tag-character sequence encoding the Wales flag false-positive exclusion, and the campaign's domain-vocabulary and envelope patterns. Rules below are built only from those artefacts.

rule PHISHING_ASCII_Smuggling_Unicode_Tags_Evasion
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-04"
        reference = "https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/"
        description = "Detects invisible Unicode tag-block characters (U+E0000-U+E007F) used to split financial lure keywords for mail-filter evasion, as observed in the Feb-May 2026 finance-themed phishing campaign. Excludes the England/Scotland/Wales subdivision flag emoji sequences, which legitimately use this range."
        note = "Applies to raw email bodies, .eml/.msg files, and any text artefact ingested for analysis. Presence of tag-block characters outside flag-emoji sequences is rare in legitimate traffic and is itself a high-confidence signal."

    strings:
        // Invisible TAG SPACE spliced inside lure keywords (observed technique)
        $tag_space_funding = "fun\x{e0020}ding" wide ascii
        $tag_space_loan    = "loan" wide ascii
        // Generic tag-block characters (U+E0000-U+E007F), UTF-8 encoded
        $tag_block_1 = { EE 80 80 }   // U+E0000
        $tag_block_2 = { EE 80 A1 }   // U+E0021
        $tag_block_3 = { EE 80 A7 }   // U+E0027
        $tag_block_4 = { EE 80 BF }   // U+E007F (terminating tag)
        // UTF-16LE encoding of tag-block range
        $tag_block_u16 = { 00 E0 00 E0 } wide

    condition:
        // Require tag-block presence; flag-emoji exclusion handled by requiring
        // tag characters NOT preceded by the black flag base code point U+1F3F4
        // (simplified: rely on combination with finance vocabulary below, or
        // tune per environment after baseline).
        2 of ($tag_block_*) or $tag_space_funding or $tag_block_u16
}

Implementation note: the England/Scotland/Wales flag false positives arise from tag sequences following the black flag base code point U+1F3F4 (UTF-8: F0 9F 8F B4). In a mail-pipeline implementation, exclude tag-block hits within N bytes following that sequence. YARA's string model cannot cleanly express "not preceded by," so tune the condition against your own baseline; Microsoft observed remaining benign artefacts from gateways and researcher mail.

title: Inbound email from finance-vocabulary disposable domain with marketing-platform envelope sender
id: (generated on import)
status: experimental
description: >
  Detects the infrastructure fingerprint of the ASCII-smuggling finance phishing
  campaign documented by Microsoft (Feb-May 2026): header sender domains built
  from three or more adjacent finance/brand word-tokens, relayed with an
  ActiveCampaign-shaped envelope sender (em-<digits> / acems<digits> / emsd<digits>).
  Optionally corroborated by sending IP in 173.236.20.0/24 (shared legitimate
  platform egress - scoping signal only).
references:

  - https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/
author: Adverse Trace
date: 2026-09-04
logsource:
  category: email
  product: m365
detection:
  selection_sender_domain:
    SenderFromDomain|re: '(?i)(capital|fund|hedge|express|solutions|choice|lend|growth|loan|loc|finance|business|pillar|advance|boost|catalyst|digital|direct|elevate|guardian|harbor|online|pulse|rocket|rush|united|wave|way|surge|swift|elite)(capital|fund|hedge|express|solutions|choice|lend|growth|loan|loc|finance|business|pillar|advance|boost|catalyst|digital|direct|elevate|guardian|harbor|online|pulse|rocket|rush|united|wave|way|surge|swift|elite)(capital|fund|hedge|express|solutions|choice|lend|growth|loan|loc|finance|business|pillar|advance|boost|catalyst|digital|direct|elevate|guardian|harbor|online|pulse|rocket|rush|united|wave|way|surge|swift|elite)'
  selection_envelope:
    SenderMailFromDomain|re: '(?i)(em-|acems|emsd)\d'
  condition: selection_sender_domain and selection_envelope
falsepositives:

  - Legitimate financial-services marketing senders using the same marketing platform; validate against known vendor lists before actioning
level: high
tags:

  - attack.initial_access
  - attack.t1566
  - attack.defense_evasion
  - attack.t1027

For Microsoft Defender for Office 365 environments, Microsoft's published KQL hunts in §4 (P1) provide the equivalent detection directly against EmailEvents/EmailUrlInfo.

7. Sources

• Microsoft Security Blog — ASCII smuggling crosses over from AI prompt injection to phishing evasion — https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/ — 2026-09-03
• Dark Reading — 1M+ Emails Use Hidden Text to Dupe AI Security Filters — https://www.darkreading.com/threat-intelligence/1m-emails-hidden-text-dupe-ai-security-filters — (corroborating coverage of the hidden-text evasion trend)
• The Register — AI spam filters are getting suckered by old-school text salting — https://www.theregister.com/security/2026/07/17/ai-spam-filters-are-getting-suckered-by-old-school-text-salting/5274434 — 2026-07-17 (Barracuda text-salting reporting; distinct technique, same target class)
• The Hacker News — Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails — https://thehackernews.com/2026/08/microsoft-365-aitm-phishing-hijacks.html — 2026-08 (context: separate finance-targeted phishing campaign; not the same activity)

8. Adverse Trace position

This is a technique-crossover advisory of moderate direct severity but high strategic significance for EMEA financial services. The direct campaign risk is contained: the observed phase ran February–May 2026, Microsoft reports over 99% of messages were caught by layered MDO protections not dependent on the Unicode signal, and the lure class (advance-fee/credential-harvesting business-loan phish) is a known fraud pattern. However, the strategic finding is the important one: a technique incubated in AI prompt-injection research has been operationalised at million-message scale against production mail filters, and parallel Barracuda reporting on text salting confirms ML/LLM-based classifiers are the target class, not a side effect. Clients running mail security that relies on keyword, regex, or tokenisation-based classification without a preceding Unicode-normalisation step — or feeding raw message text into LLM analysis — should treat this as a live capability gap, not a historical note. All campaign specifics are single-sourced from Microsoft; verify against your own telemetry before enforcement, and do not block the shared ActiveCampaign infrastructure. Our next steps: we will monitor for independent corroboration of this campaign, for post-May continuation under new evasion variants (Microsoft states the broader campaign continues), and for further crossover of ATLAS-class AI techniques into conventional threat ecosystems; we will update this advisory if corroborating reporting or new campaign phases emerge.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.