Phishing Evolves with ASCII Smuggling, Deceiving Email Filters

In the first half of February, Microsoft detected a jump from 21,000 to over 1.3 million daily ASCII smuggling signatures in email messages, reaching 2.5 million in four days. This abrupt increase in spam using the technique has heightened the search for information about phishing.

What is ASCII Smuggling?

ASCII smuggling involves inserting Unicode codes from the U+E0000 to U+E007F range, which reproduce ASCII characters but are not rendered by common fonts. The text remains readable for processing software but invisible to the user.

How the Technique Bypasses Security Filters

Filters that search for keywords like “credit” or “funding” analyze the literal text. By placing an invisible character in the middle of a word, the filter reads “fun” and “ding,” while the recipient sees the complete word. This obstruction also prevents language model tokenizers from recognizing the entire term.

Relationship Between ASCII Smuggling and Phishing

Criminals use this method to send phishing emails that go unnoticed by machine learning-based detection systems. After bypassing the filter, the message contains malicious links or codes that, when clicked, can steal personal and financial data.

Recommended Protection Measures

To reduce the risk, keep bank account passwords updated, avoid clicking on URLs or QR Codes sent in unexpected messages, and only install applications from official stores. Updating your operating system and using recognized antivirus software also helps block attack attempts.

What Security Research Indicates

Microsoft researchers observed that the same property that makes invisible characters useful for AI model instructions also serves to hide keywords from filters. They warn that as filters evolve, techniques like ASCII smuggling may be adapted for new types of threats.

With information from Ars Technica, Deccan Herald.