Once popular for attacking AI, ASCII smuggling is embraced by spammers
ars ·
ASCII smuggling, a technique that uses invisible Unicode characters to hide text from humans while computers can read it, is now being used by spammers to evade email filters. The technique was previously used to make AI prompt injection attacks more stealthy. Microsoft reported a massive spike in spam emails using ASCII smuggling, rising from about 21,000 detections per day to over 2.5 million daily detections within a few days in early February. Spammers embed invisible characters into words like 'funding' so that text-processing filters and machine-learning tokenizers no longer recognize the original keyword. This allows the spam to bypass detection because the hidden characters disrupt string matching and tokenization. Microsoft has published guidance for developers on how to adjust filters to better detect this kind of evasion.
ars