Massive phishing campaign used invisible Unicode to split keywords
They publishedASCII smuggling isn't just an AI security risk
Who / What / Where / When
Who
What
- Microsoft detected a phishing campaign using invisible Unicode tag characters.
- Campaign peaked at over 2.37 million messages in late February.
- Emails showed a weekday-on, weekend-off pattern with gradual decline.
- Attackers split financial keywords with non-rendering characters to evade filters.
- Researchers urge normalization and tokenization to strip invisible code points.
Where
Unknown (outlet HQ)
topics: Cybersecurity, Finance · language: eng
topics: Cybersecurity, Finance · language: eng
When
published 4 Sept, 19:23Z
ingested 4 Sept, 22:02Z
ingested 4 Sept, 22:02Z
Rewrite
original kept above, struck through · model ?
Retrieved
https://www.theregister.com/security/2026/09/04/ascii-smuggling-isnt-just-an-ai-security-risk/5294595
Everything above is the full audit trail for this article: source, country, timestamps, the original headline, and the model that rewrote it. Nothing is hidden.