ASCII Smuggling Phishing Campaign via Invisible Unicode Characters

Technical Analysis

The ASCII smuggling technique leverages Unicode characters such as zero-width spaces, tag characters, and other invisible or non-rendering code points (e.g., U+200B, U+E0000-U+E007F range) to fragment or hide malicious text strings like URLs, keywords, or instructions from signature-based and NLP-driven email security filters, while the content still renders normally or misleadingly to end users. This evades detection engines that rely on literal string matching or standard tokenization since the invisible characters break up flagged terms without altering visual presentation. The technique can also be used to inject hidden instructions into text that may be ingested by downstream systems performing automated text processing. For organizations deploying LLM-based email triage, summarization agents, or RAG pipelines that ingest raw email content, this technique poses a direct risk: invisible Unicode sequences can smuggle hidden prompt injection payloads or malicious instructions past both human review and automated security scanning, potentially manipulating agent behavior when the agent parses and tokenizes the concealed text.

Affected Systems

Email security gateways and filters using keyword/pattern-based detection, corporate email clients (Outlook, Gmail, etc.), automated email parsing and triage systems, LLM-based email summarization or agent tools that ingest raw email text without Unicode normalization

Indicators of Compromise

• No specific hashes, IPs, or domains disclosed in source reporting; indicators are behavioral (presence of zero-width/invisible Unicode characters such as U+200B, U+2060, U+FEFF, or Unicode Tags block U+E0000-U+E007F within email body/subject text)

Remediation Steps

1. 1

   Implement Unicode Normalization

   Configure email security gateways and text-processing pipelines (including LLM/agent input sanitization) to normalize and strip invisible/zero-width Unicode characters before content analysis.

2. 2

   Enhance Detection Rules

   Update email filtering rules to flag messages containing unusual concentrations of invisible or non-printing Unicode code points as suspicious.

3. 3

   Sanitize Agent Inputs

   For AI agent and RAG systems that process email or user-submitted text, apply Unicode sanitization and normalization (NFKC) prior to tokenization to prevent hidden prompt injection or instruction smuggling.

4. 4

   User Awareness Training

   Educate users on phishing indicators and encourage reporting of suspicious emails even when they appear to pass security filters.

5. 5

   Deploy Advanced Content Inspection

   Use security tools capable of rendering and inspecting the visual/semantic content of emails rather than relying solely on raw text pattern matching.