Technology
Spammers adopt ASCII smuggling technique to bypass email filters
A Unicode obfuscation method previously used in AI prompt injection attacks is now being leveraged to evade mass-email defenses.
The short version
- Spammers are using a technique known as ASCII smuggling to bypass automated detection systems on email platforms.
- The method utilizes a set of 128 Unicode tags that mirror standard characters, allowing text to be parsed by computer systems while remaining hidden to human readers.
- Originally identified around two years ago for stealthy prompt injections against large language models, the tactic has now expanded to broader spam campaigns.
Key facts
- Spammers have begun utilizing ASCII smuggling to evade mass-campaign email filters.[Ars Technica]
- The technique relies on a range of 128 Unicode tags that mirror standard ASCII characters, rendering them readable to software but largely invisible to human recipients.[Ars Technica]
- ASCII smuggling first gained attention approximately two years ago as a way to hide malicious prompt injections targeting large language models and AI agents.[Ars Technica]
What remains uncertain
- The extent to which major email providers are currently tracking or successfully mitigating these ASCII smuggling techniques has not been detailed.[Ars Technica]
Sources
Outlet counts describe coverage, not independent confirmation. Reports may share a wire service or original source.