ASCII smuggling hits 1.3M phishing messages

Microsoft saw an ASCII-smuggling phishing campaign push its detection signature from roughly 21,000 messages to more than 1.3 million in one day, after an AI-prompt-injection defense surfaced the activity. Microsoft’s threat-intelligence report says layered Defender protections flagged more than 99% of messages without relying on the Unicode-specific signal; it observed the finance-themed campaign for roughly three months. Builders should treat AI-era evasion as a mail-security problem too and normalize hidden characters before matching, extending the case for agent security firewalls.