Full Report
Phishers find a new use for invisible Unicode tag characters
Analysis Summary
# Tool/Technique: ASCII Smuggling (Unicode Tag Character Evasion)
## Overview
ASCII smuggling is a technique that leverages invisible or non-rendering Unicode tag characters (specifically from the `U+E0000` to `U+E07FF` range) to hide content within human-readable text. Originally identified as a method for Indirect Prompt Injection against AI models, it has been adapted for traditional phishing to bypass security filters by "splitting" keywords that would otherwise trigger malicious content alerts.
## Technical Details
- **Type:** Technique (Evasion / Obfuscation)
- **Platform:** Email Clients, Web Browsers, AI Models/LLMs
- **Capabilities:** Bypassing keyword-based security filters, hiding malicious prompts from human users, evading signature-based detection.
- **First Seen:** Early February 2026 (Significant campaign activity detected February – June 2026).
## MITRE ATT&CK Mapping
- **[TA0005 - Defense Evasion]**
- **[T1027 - Obfuscated Files or Information]**
- **[T1566 - Phishing]**
- **[T1566.001 - Spearphishing Attachment/Link]** (Contextual application)
## Functionality
### Core Capabilities
- **Keyword Splitting:** Inserting Unicode tag spaces (e.g., `U+E0020`) between letters of high-risk words (e.g., "funding" becomes "fun⟨U+E0020⟩ding"). This causes literal signature matches and regex filters to fail while remaining invisible to the recipient.
- **Content Hiding:** Embedding instructions or data that are invisible to the human eye but interpretable by automated systems (AI models or tokenizers).
### Advanced Features
- **Cross-Domain Adaptation:** The ability to transition an "AI-specific" exploit (Indirect Prompt Injection) into a traditional email infrastructure attack.
- **Filter Evasion:** Specifically designed to circumvent secure email gateways (SEGs) that rely on static analysis of financial or urgent lures.
## Indicators of Compromise
- **File Hashes:** N/A (Technique is text-based).
- **File Names:** N/A.
- **Registry Keys:** N/A.
- **Network Indicators:**
- Approximately 150 finance-themed sender domains (e.g., disposable domains used for bulk phishing).
- **Behavioral Indicators:**
- High-volume email spikes on weekdays (1M - 2.37M messages) with total silence on weekends.
- Presence of Unicode Tag Block characters (`U+E0000`–`U+E007F`) within the body of emails, particularly within financial keywords.
- High churn rate of sender domains associated with finance-themed lures.
## Associated Threat Actors
- Unknown (Large-scale phishing/spam operation characterized by strict weekday activity).
## Detection Methods
- **Signature-based detection:** Scanning for Unicode code points in the range `U+E0000` to `U+E007F` within email bodies.
- **Behavioral detection:** Monitoring for sudden spikes in traffic from finance-themed domains that exhibit "on-off" weekly cycles.
- **Normalization Analysis:** Comparing raw email text against normalized (stripped) text to identify hidden character injections.
## Mitigation Strategies
- **Input Normalization:** Ensure security pipelines (normalization and tokenization) strip or fold invisible/non-rendering Unicode characters before evaluating text via regex or keyword matching.
- **Content Filtering:** Update Secure Email Gateways (SEGs) to flag or quarantine messages containing excessive Tag Block characters.
- **AI Safety:** For AI assistants ingesting email, implement pre-processing layers to remove smuggled instructions before the prompt reaches the LLM.
## Related Tools/Techniques
- **Indirect Prompt Injection:** The parent technique used against LLMs.
- **Homograph Attack:** Using similar-looking Unicode characters to spoof domains (related but distinct from invisible smuggling).
- **Zero-Width Space Obfuscation:** A similar technique using characters like `U+200B` to break signatures.