Hidden text attacks aren't just an AI problem

Most mail clients now silently replace a Cyrillic "а" with a Latin "a" before they show you a sender name. They do that because the trick, a homograph, a character that looks like a normal letter but is not, is one of the oldest in phishing. The version that crossed into commodity email in February 2026 is harder to see: invisible Unicode tag characters, in the U+E0000 to U+E007F range, that the eye cannot read at all.

Microsoft's Defender for Office 365 team calls the broader pattern ASCII smuggling. The same invisibility that lets an attacker smuggle instructions past a human reviewer and into a language model also lets the attacker smuggle a word like "funding" past a mail filter. The intent is inverted; the mechanism is identical.

On February 8, 2026, Microsoft's tuned ASCII-smuggling signature caught roughly 21,000 messages. The next day, February 9, it caught more than 1.3 million. The signature peaked at over 2.3 million messages on February 11 and held a high-volume, weekday-cadence pattern for roughly three months, through May 15. That cadence is the tell: the rhythm of scheduled bulk-sending infrastructure, not a one-off campaign.

The activity clustered around about 150 finance-themed sender domains. The lure technique was simple: split a financial keyword such as "funding" with tag characters so a parser cannot reassemble the word, but a human reader still sees a clean subject line. The smuggled string travels with the message. The filter sees a string of letters; the recipient sees a string of letters; only a renderer that walks the characters and resolves the hidden ones can see the keyword the sender wanted to slip past the filter.

The Ars Technica writeup traces it back to 2025 AI red-team and cross-prompt injection research, where the open-source ASCII Smuggler tool from Embrace The Red and the Promptfoo documentation used the same U+E0000 to U+E007F range to hide instructions from human reviewers before feeding them to a model. The crossover to phishing is the news: the AI-only technique became commodity email infrastructure at scale, with The Register, SC Media, and The Hacker News all amplifying Microsoft's telemetry the same week.

Unicode normalization, allowlists that resolve every character to its canonical form before scoring, and rendering inspection that flags messages where the rendered string differs from the stored string have been in mail stacks for years. The false-positive wrinkle shows how deep the problem runs: a naive U+E0000 to U+E007F signature also fires on the England, Scotland, and Wales subdivision flag emojis, which are encoded with the same tag characters. Microsoft's tuned signature has to distinguish malicious smuggled keywords from country flags. That is the harder problem to maintain at scale.

Hidden text attacks, instructions or identifiers smuggled inside ordinary-looking text using invisible characters, are not new. They include homographs in sender names, right-to-left overrides that flip a terminal command's argument, zero-width joiners inside an otherwise clean line of source code, and now invisible tag characters in email subjects and bodies. The 2025 AI red-team research gave the primitive a louder name because of one property: language models will act on smuggled text without a human ever reading it. A person glances at a message subject and sees a clean word; a model reads the raw token stream and processes the smuggled one. LLM pipelines are uniquely dangerous for that reason. The inbox version is the same primitive with the intent inverted: a filter that does not render what the recipient will see.

The reusable question is where else in the stack this primitive shows up. Email senders are the obvious one. Terminal input, code review, search and CMS inputs, and OAuth redirect URIs are the rest. A redirect URI built from a homograph, an RTL override in a command, an invisible joiner in a source string, or a hidden tag in a search query all hit the same family. The mitigations transfer across every one of them: normalize the input to its canonical form, score against an allowlist, and render before you trust.

Microsoft's telemetry will keep showing peaks. The next one is worth watching less for the volume than for which surface it lands on.