ASCII smuggling phishing: what Microsoft 365 defenders need to know
Microsoft 365 Business Premium includes Defender for Office 365 Plan 1, making this a configuration and operating-model issue as much as a licensing issue. Organizations should first confirm they are using the protection they already own effectively.
Microsoft 365 Business Premium includes Defender for Office 365 Plan 1, making this a configuration and operating-model issue as much as a licensing issue. Organizations should first confirm they are using the protection they already own effectively.
Microsoft observed ASCII smuggling used for phishing evasion at scale
Microsoft Security Research reported a high-volume phishing campaign that inserted invisible Unicode tag characters into finance-themed lure words. The visible message still looked normal to a person, while the underlying text could frustrate simplistic keyword or signature matching.
Microsoft reported that the activity reached multi-million-message daily volume at its peak. More importantly, Microsoft said more than 99% of the observed messages were still flagged by protection layers that did not depend on directly detecting the Unicode tag characters.
How ASCII smuggling can hide text in plain sight
The technique abuses invisible or non-rendering Unicode characters. An attacker can insert these characters inside a word that appears ordinary on screen. A human may read the intended word while a detection pipeline that does not normalize the text may process a different underlying sequence.
Invisible-character evasion is not entirely new. What makes this development notable is the use of the Unicode Tags block associated with recent AI prompt-injection research, combined with the scale of the phishing campaign Microsoft observed.
What this means for Defender for Office 365
This campaign is a good reminder that Microsoft 365 email protection should be configured as a layered control system. Microsoft describes Defender protections that include content analysis, sender and domain reputation, URL analysis, bulk-mail detection, anti-phishing models, authentication checks, and other signals.
Organizations should resist the temptation to treat one new detection as the remediation. A tenant with weak anti-phishing configuration, poorly protected executives, permissive external forwarding, weak domain authentication, or no alert ownership remains exposed even if Microsoft adds a signature for this specific technique.
What Microsoft 365 administrators should verify now
- Review anti-phishing and impersonation protection for executives, finance personnel, and high-value domains.
- Confirm Safe Links and Safe Attachments policies are configured appropriately for the organization’s licensing and risk.
- Validate SPF, DKIM, and DMARC alignment for owned sending domains; use DMARC enforcement where the mail ecosystem is ready.
- Review anti-spam and bulk-mail settings rather than relying only on Microsoft defaults.
- Confirm external auto-forwarding and suspicious inbox-rule scenarios are controlled and monitored.
- Make sure users have a clear way to report suspicious messages and that reported messages have an operational owner.
- Review Defender alerts and investigation workflows so detections turn into timely action.
- For custom gateways or content-processing pipelines, verify that invisible Unicode is normalized before keyword, signature, or regex evaluation.
The bigger lesson: AI-era attack techniques will cross domains
ASCII smuggling became prominent because invisible text could create a gap between what a human sees and what an AI system processes. Microsoft’s research shows the same mechanism can be repurposed against traditional email defenses.
Organizations introducing AI assistants should therefore think about both sides of the problem: email and web content must be safely processed for traditional detection, and the same untrusted content should not become an instruction channel for an AI agent with excessive permissions.
A practical response checklist
- Validate the Microsoft 365 email baseline. Start with anti-phishing, impersonation, Safe Links, Safe Attachments, domain authentication, forwarding, and reporting.
- Protect high-value populations. Finance, executives, administrators, and payment workflows deserve explicit review.
- Confirm operational ownership. Decide who reviews alerts, reported messages, and suspicious sign-ins after a phishing event.
- Test rather than assume. Use controlled security testing to validate mail-flow and detection behavior without weakening production protections.
- Connect email security to identity. Phishing-resistant authentication limits the value of credentials even when a user reaches a convincing lure.
That last point is especially timely: Microsoft is actively moving Entra users away from SMS and voice authentication. See our Entra passkey migration guide.
Microsoft Security Research
Microsoft published the underlying threat research on September 3, 2026: ASCII smuggling crosses over from AI prompt injection to phishing evasion.