Spammers are now utilizing a technique involving invisible Unicode characters to bypass email security filters. This method, which uses a specific set of 128 characters, was previously employed to inject malicious instructions into artificial intelligence models by hiding commands within seemingly harmless text.
Microsoft reports that this tactic is now being used to evade spam detection systems. By inserting invisible characters into the middle of keywords like financial terms, spammers prevent automated filters and machine learning models from identifying prohibited content, as the computer fails to recognize the modified words.
The scale of this activity was significant, according to Microsoft Defender for Office data. In early February, the volume of emails containing these hidden symbols surged from 21,000 to 1.3 million per day. Within four days, the figure reached 2.5 million daily messages.
This high volume of spam persisted for several months before experiencing a sharp decline at the end of May. Microsoft notes that traditional spam filters often struggle to detect these manipulations and suggests that optical character recognition tools are currently the most effective way to identify such hidden text.