Phishers hide in plain sight with invisible ASCII characters

Attackers turn AI prompt trick into phishing evasion tool

Criminals are using 'invisible' ASCII characters to distribute phishing emails that bypass spam filters.

Email filters regularly check for messages containing words like 'credit', 'loan' and 'refund' and automatically send most of them to a spam folder.

However, attackers have started to bypass the filters using the ASCII character encoding standard.

ASCII turns human-readable text into numeric values computers can understand, but this isn't the extent of its capabilities; it can also create characters that aren't displayed on-screen, but can still be 'seen' by machines.

This technique, known as ASCII Smuggling, first appeared in prompt injection attacks targeting AI systems. For example, an attacker could hide instructions in invisible characters embedded in a web page, document or email. A human would not see them, but an AI assistant would accept them as a valid instruction.

Now, Microsoft researchers have observed a "high-volume" phishing campaign using the same approach. However, instead of hiding instructions the attackers instead use the invisible characters to split commonly filtered words and bypass email defences.

As an example, 'funding' might become 'fun⟨U+E0020⟩ding'. A machine will see exactly what is written and fail to detect spam words, while a human will see only the plain text message.

The researchers were examining how AI-era evasion techniques can surface in traditional phishing campaigns. They saw the first hints of an ASCII smuggling attack at scale in February this year, with traces remaining elevated on weekdays for around three months.

Detecting invisible attacks

No cyber threat is wholly undetectable, and the fact that machines can see the hidden Unicode characters in this attack is actually the best way to defend against it.

"Since this kind of manipulation appears so seldom in normal traffic, its presence becomes a high-confidence signal," Microsoft's researchers write.

"A technique meant to make messages look more benign to ML models can instead give defenders a low-false-positive indicator to detect on."

The most common Unicode characters to watch for are in the range U+E0000 - U+E007F, specifically U+E0020, spliced inside keywords (emojis for the flags of England, Scotland and Wales are also encoded this way, but are easily excluded from filters).

This particular campaign also used a small subset of sending domains, all formed of a random mishmash of just 28 word tokens like "advance," "business," "funding," "rush" and "capital."