Cybercriminals and spammers have adopted "ASCII smuggling"—a obfuscation technique originally developed by security researchers to jailbreak large language models—to bypass mainstream email security filters and spread malicious links undetected.
The technique exploits hidden Unicode characters, such as Tag Characters or non-printable zero-width spaces, to embed hidden text and URLs within ordinary-looking messages. While human recipients and basic text renders only see clean prose, automated filters decode the hidden characters, triggering redirect loops or hidden payloads. Security firms report a sharp rise in phishing campaigns utilizing ASCII smuggling, warning that legacy enterprise gateway filters remain ill-equipped to parse invisible Unicode variations.
