Microsoft Defender logged ASCII smuggling signatures rising from 21,000 to 2.5 million daily in early February spam campaigns

Spammers adopted the Unicode tag block previously used for prompt injection attacks. The 128 characters map directly to ASCII letters yet render invisible to human readers while remaining visible to text processors and LLMs. Microsoft observed the technique applied to keyword obfuscation rather than instruction smuggling, inverting the original attack goal while preserving the same evasion property against content filters.

Detection data came from Microsoft Defender for Office 365 signatures. Volume stayed elevated for roughly three months after the initial February spike, then dropped without public disclosure of new filter rules. This pattern matches earlier shifts in spam infrastructure when detection thresholds tightened around zero-width characters and homoglyph substitution.

Operationally the change forces email gateways to expand Unicode normalization and tag stripping before any downstream classifier runs. Defenders must now treat invisible tag ranges as equivalent to base ASCII for policy evaluation. Failure to normalize leaves both spam campaigns and residual prompt-injection vectors unblocked at the boundary layer.