ASCII smuggling isn't just an AI security risk

Microsoft researchers uncovered a large phishing campaign that inserted invisible Unicode tag characters into financial keywords (ASCII smuggling) to evade keyword and signature filters; the activity produced weekday-peaking volumes that reached over 2.37 million messages and persisted with a gradual decline through mid-June. Defenders are advised to normalize and strip non-rendering Unicode code points before keyword/signature evaluation and to watch behavioral indicators such as high-volume, finance-themed disposable domains with a weekday-on/weekend-off pattern.