Spammers have found a way to dodge your inbox's spam filter: make part of a flagged word invisible.
Microsoft's security team says attackers are inserting invisible Unicode characters into words that typically trigger spam filters, like "funding" or "loan", splitting them apart so the filter sees gibberish while a human reader still sees the normal word. The technique, known as ASCII smuggling, is borrowed from prompt injection attacks used against AI models. Microsoft says the campaign has run for months, peaked in February 2026 at more than 2.3 million emails a day, and has declined since without fully stopping. In early February, a cluster of about 150 finance-themed sender domains accounted for 96% of the ASCII-smuggling spam that Microsoft's Defender for Office 365 flagged.
This stopped being a pure spam-filter problem the moment AI entered the inbox. An AI agent asked to summarize an email reads the same invisible characters as part of its input, so a hidden string can double as a prompt injection - quietly instructing the assistant to leak data or take an action the user never requested. That turns Microsoft's suggested fix, normalizing Unicode text before scanning it, into an AI-safety patch as much as a spam-filter one.
It is a reminder that any system built to read text the way a human sees it is only as reliable as its normalization step, and right now a lot of inboxes and AI agents skip that step entirely.