[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWMxWYn7HhuQ0ir-azW7nYgxoxJr4MPEWAs0Z99b2nUE":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48,"controls":49},"d2c503c0-57cd-4653-a47b-01519ce4fced","invisible-unicode-characters-enable-phishing-filter-evasion-via-ascii-smuggling","d9f321cd-3811-4a20-b527-f676eb616d59","Invisible Unicode Characters Enable Phishing Filter Evasion via ASCII Smuggling","Attackers are exploiting invisible Unicode tag characters to split financial lure keywords in phishing emails, bypassing traditional email content filters that cannot parse these hidden characters. This technique, originally developed in AI prompt injection research, demonstrates how offensive methods rapidly migrate from one threat domain to another — in this case from AI jailbreaking to conventional phishing campaigns. The core failure is that email security tooling was not designed to account for non-rendering Unicode characters as a text obfuscation vector. This matters because organizations relying solely on keyword-based filtering are now blind to a growing category of evasion techniques, leaving employees exposed to convincing financial-themed lures. The sharp increase in detections by Microsoft Defender for Office 365 signals this is an active, scaling threat requiring immediate defensive adaptation.","**Immediate actions:**\n- Update and validate email security gateway configurations to normalize and strip non-printable Unicode tag characters (U+E0000 block) before content inspection.\n- Enable advanced heuristic and ML-based phishing detection in your email security platform (e.g., Microsoft Defender for Office 365, Proofpoint, or equivalent) to catch obfuscation patterns beyond keyword matching.\n\n**Long-term improvements:**\n- Establish a process to continuously monitor threat intelligence feeds and translate emerging AI-era evasion techniques into updated detection signatures and filter rules.\n- Conduct regular phishing simulation exercises that include novel obfuscation techniques so employees learn to scrutinize suspicious emails regardless of how lure text appears.\n- Implement a Zero Trust email handling policy requiring suspicious or external emails to be sandboxed and rendered in an isolated environment before delivery.\n\n**Detection measures:**\n- Deploy SIEM correlation rules to alert on emails containing high concentrations of non-printable or Unicode tag characters as a potential evasion indicator.\n- Monitor and log all email filter bypass events and route them to a security analyst queue for manual review and threat hunting.",[12,13,14,15,16,17,18,19,20],"CIS Control 9: Email and Web Browser Protections","CIS Control 17: Security Awareness and Skills Training","NIST SP 800-61 Rev 2: Incident Handling for Phishing","NIST SP 800-177: Email Authentication Recommendations","NIST CSF DE.CM-7: Monitoring for Unauthorized Activity","MITRE ATT&CK T1027: Obfuscated Files or Information","MITRE ATT&CK T1566.001: Spearphishing Attachment","GDPR Article 32: Security of Processing (if PII is at risk via phishing)","ITIL: Continual Service Improvement — adapting controls to emerging threats",{},"published","2026-09-03T18:20:23.765458+00:00","2026-09-03T18:20:23.658+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F09\u002F03\u002Fascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion\u002F","ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion-a60156","ASCII smuggling crosses over from AI prompt injection to phishing evasion",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":37,"name":38,"slug":39,"description":40,"color":41},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":43,"name":44,"slug":45,"description":46,"color":47},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[50,54,58],{"slug":51,"name":52,"problem":53},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":55,"name":56,"problem":57},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":59,"name":60,"problem":61},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]