Loading today’s stories
Security1 distinct publisher2 min readPublished
A hunting signature Microsoft built to catch prompt injection in email started firing on ordinary phishing instead, where invisible tag characters were splitting lure words like "funding" so filters never parsed them.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
The evasion turns on the gap between the string a person reads and the string a matcher tokenizes. Drop code points from the Unicode Tags block between the letters of a lure word and the message still reads normally to the recipient, because typical fonts and interfaces do not draw those code points [4], while the rule looking for "funding" has nothing left to match [2]. The block is a shadow copy of printable ASCII, so there is an invisible twin of every letter: U+E0041 for "A", U+E0061 for "a" [3]. The range holds 128 code points [13], deprecated language-tagging leftovers that sit in text-processing paths most detection content was never written to normalize [3].
The AI security literature made the same block famous running the technique the other way: hidden instructions that a human never sees and an assistant ingesting raw text decodes and may act on, up to data exposure depending on its permissions [11]. That pattern filled red-teaming write-ups, talks and tooling through 2025 [10]. Microsoft's hunt was built for that problem, as part of Defender for Office 365 prompt injection protection, and it is the hunt that surfaced the phishing use [7]. Intent inverted, mechanism unchanged.
Dates. Signature hits climbed sharply from 9 February 2026 and stayed elevated on weekdays for roughly three months [5], which puts the end of that window near 9 May. Microsoft published on 3 September 2026 [12], close to four months after the elevated stretch and about seven months after onset [14]. The weekday shape is worth keeping in mind: mail sent on a work calendar, into work inboxes.
The tuning story is the part detection teams will pay for. Version one flagged any code point in the range and was too blunt, firing on legitimate mail carrying the England, Scotland and Wales flag emojis, which are themselves encoded with tag characters [8]. After those exclusions the residue was gateways, mailbox providers and researchers forwarding test messages, which is a baseline rather than a verdict, useful because spikes stand out against it [9].
Two limits on the read. Microsoft says most of these messages were caught by layered protections, not by the Unicode signal alone [6], so stacks were not blind here. And the write-up names no actor and gives no message counts [15]. This is a technique report on a filter bypass, not an attribution.
Ranked by verification strength, evidence, and original report placement.
Microsoft researchers observed a high-volume phishing campaign using invisible Unicode tag characters, a technique popularized in AI prompt injection research as ASCII Smuggling.
Instead of hiding instructions from people while exposing them to AI models, the attacker used the tag characters to split financial lure words such as 'funding' to prevent email filters from parsing them.
The most abused range is the Unicode Tags block, U+E0000 to U+E007F, which contains a shadow copy of the printable ASCII characters (U+E0041 mirrors 'A', U+E0061 mirrors 'a'); it was originally intended for language tagging and is now largely deprecated.
Most of these code points are not rendered by typical fonts and user interfaces, so a string can carry a message unreadable to a human but processed by any language model or other software that receives a copy of the email content.
In Microsoft telemetry, hits on a hunting signature designed to detect ASCII smuggling increased sharply beginning February 9, 2026, and remained elevated on weekdays for approximately three months.
The first version of the signature flagged any code point in the U+E0000-U+E007F range and proved too blunt, repeatedly firing on a small subset of legitimate messages that all contained one of three subdivision flag emojis - England, Scotland and Wales - because those emojis are encoded using tag characters.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · September 3, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
build
ShieldBreak: a Defender-to-SYSTEM PoC that your last patch cycle did not stop1 distinct publisher
security
SharePoint RCE detections keyed to one exploit will miss the other, after CVE-2026-63520 leaks early2 distinct publishers
security
Copilot told Varonis how to break it, and that is the third one-click leak this year2 distinct publishers
build
Microsoft is generating its detection test logs, and admitting what they do not prove1 distinct publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Detailed, dated, and entirely first-party
Two very different kinds of fact sit side by side here. The Unicode part — the Tags block, its ASCII shadow, the fact that a Wales flag decomposes into an invisible sequence spelling gbwls — anyone can check in an afternoon. The campaign part exists only inside Microsoft's mail telemetry: the 8 February baseline, the 1.3-million-message day, the 150 domains, the mid-May falloff. Those numbers are specific and dated, which is better than most vendor write-ups manage, but no second platform has said it saw the same thing.
Attackers adopted it; the numbers are one vendor's
Uptake here belongs to the phishing crews, and it is not marginal: a sixty-fold jump in a single day, roughly 150 sender domains moving together, and a three-month run with weekends off. What we cannot see is spread — whether the same trick was hitting mailboxes outside Microsoft's estate, and whether anything replaced it after 15 May. Defender-side adoption of the detection is real but narrow, confined to one vendor's hunting logic.
Novel framing, familiar behaviour
The crossover story is genuinely interesting, and it is also the most flattering way to describe what happened: attackers found fresh code points for the oldest trick in email evasion, breaking a word so the matcher misses it. Microsoft deserves credit for deflating its own drama — it says outright that layered protections, not the Unicode signal, caught most of the mail. The tilt upward is small and comes from the AI framing carrying more weight than the underlying technique, which involves no model at all.
Sensor, product and byline are the same company
Microsoft wrote the hunt, owns the telemetry, sells the mail filter that blocked the messages, and published the post. Nothing in the write-up is implausible because of that, and the layered-protections caveat cuts against its own marketing. But the seven-month gap between onset and disclosure is worth naming: this went out after the wave had ended, as a story about how prompt-injection research paid off elsewhere, not as a warning while mail was landing.
Trust the mechanism, hold the scale loosely
We are confident about how the trick works and about the flag-emoji trap, both checkable. We are moderately confident about the campaign's shape, because the figures are precise, internally consistent and come from the only party positioned to count them. We are least confident about anything the post declines to say: who ran it, whom it reached, and whether the absence of an actor name reflects genuine ambiguity or an editorial decision.