ASCII密寫評測：AI提示注入技術，駭客拿來群發釣魚信 | ASCII Smuggling Review: AI Prompt Injection Hits Phishing Inboxes
By Kit 小克 | AI Tool Observer | 2026-09-05
🇹🇼 ASCII密寫評測：AI提示注入技術，駭客拿來群發釣魚信
ASCII密寫（ASCII Smuggling）原本是資安研究員拿來測試AI提示注入（prompt injection）漏洞的技巧，如今被駭客直接搬去群發釣魚信。微軟資安團隊9月3日發布報告指出，這波釣魚活動從今年2月就已開始，週間流量一度衝到每天237萬封信，且持續了將近三個月才明顯降溫。
什麼是ASCII密寫？為何AI圈先發現它
ASCII密寫的原理，是利用一批「不可視」的Unicode標籤字元（U+E0000到U+E007F區間），把它們插進正常文字中間。這些字元在人眼看到的畫面上完全不會顯示，但電腦程式（尤其是AI模型）在解析文字時卻讀得到。研究人員最早是拿這招來示範：只要在網頁或文件裡藏幾個看不見的字元，就能偷偷對AI助理下指令，讓它讀取隱藏的惡意提示——這正是提示注入攻擊最常見的手法之一。
駭客怎麼把技術「跨界」用在釣魚信
微軟這次發現的釣魚活動，用途完全不同：駭客不是要瞞過AI，而是要瞞過傳統的關鍵字比對防毒/防垃圾郵件系統。做法是把敏感字眼硬生生拆開，例如把「funding」寫成「fun［隱藏字元］ding」。人眼看起來字串完全正常，郵件內容照樣騙得過收件人，但過濾系統做關鍵字比對時，因為字串中間多了一段程式看不懂、卻不影響顯示的字元，就抓不到「funding」這個字，訊號直接被稀釋掉。
規模與影響
- 時間軸：微軟的偵測訊號在2026年2月9日開始明顯飆升，平日流量維持高檔約三個月
- 單日高峰：2月26日單日流量估計達到237萬封
- 發現過程：微軟其實是在研發Defender for Office 365的AI提示注入防護功能時，「順手」抓到這波流量異常，才回頭發現這是釣魚活動而非AI攻擊
對一般用戶與企業的啟示
這件事最值得注意的地方，是它證明了AI安全研究的副產品，正在回頭反噬傳統資安防線。過去大家以為ASCII密寫只是AI模型的專屬弱點，但只要防禦系統的底層邏輯仍是關鍵字比對，這招同樣有效。對企業IT來說，光靠字串比對的垃圾信過濾已經不夠可靠，需要加入Unicode正規化（normalization）步驟，先把不可視字元清掉再做比對。對一般使用者，還是那句老話：可疑連結、可疑附件不要點，寄件人地址務必核對。
資料來源
本文參考微軟資安團隊2026年9月3日發布的官方分析報告，以及The Hacker News同步報導。
好不好用，試了才知道。
🇺🇸 ASCII Smuggling Review: AI Prompt Injection Hits Phishing Inboxes
ASCII smuggling started as a proof-of-concept trick for testing AI prompt injection flaws — now attackers are using it to send phishing emails at scale. Microsoft's security team published findings on September 3 showing this campaign has been running since February 2026, peaking at an estimated 2.37 million emails in a single day, with elevated weekday volume for nearly three months.
What Is ASCII Smuggling, and Why AI Researchers Found It First
ASCII smuggling exploits a set of invisible Unicode "tag" characters (in the U+E0000 to U+E007F range) that can be embedded inside normal-looking text. These characters render as nothing on screen — a human sees clean text — but software parsing the raw string, including AI models, still reads them. Security researchers first used this to demonstrate prompt injection: hide instructions inside a webpage or document using invisible characters, and an AI assistant reading that content could be silently manipulated into following the hidden commands.
How Attackers Repurposed It for Phishing
Microsoft's discovery shows a completely different use case: attackers aren't trying to fool AI at all — they're trying to fool traditional keyword-based email filters. The technique splits sensitive trigger words apart, for example writing "fun[hidden character]ding" instead of "funding." To a human reader, the email looks completely normal and the social-engineering lure still works. But a filter doing keyword matching sees a string with an unrecognized character in the middle and fails to flag the word "funding," diluting the detection signal entirely.
Scale and Timeline
- Onset: Microsoft's detection signal spiked sharply starting February 9, 2026, with elevated weekday volume for roughly three months
- Peak volume: an estimated 2.37 million messages on February 26 alone
- How it was found: Microsoft stumbled onto this while building prompt-injection detection for Defender for Office 365 — the anomaly turned out to be a phishing campaign, not an AI attack
What It Means for Users and IT Teams
The real takeaway is that AI-security research is now leaking back into traditional attack tooling. ASCII smuggling was assumed to be an AI-model-specific weakness, but it works just as well against any defense that still relies on plain keyword matching. For IT teams, that means email filters need Unicode normalization — stripping invisible characters before pattern matching — not just literal string comparison. For everyday users, the advice hasn't changed: don't click suspicious links or attachments, and always verify the sender's actual address.
Sources
Based on Microsoft Security's official analysis published September 3, 2026, and corroborating coverage from The Hacker News.
好不好用，試了才知道。
Sources / 資料來源
- Microsoft Security Blog: ASCII smuggling crosses over from AI prompt injection to phishing evasion
- The Hacker News: Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters
- The Register: ASCII smuggling isn't just an AI security risk
延伸閱讀 / Related Articles
- Claude費馬定理評測：11天形式化，非新證明 | Claude Fermat's Last Theorem Review: Formalized, Not New
- MAI-Transcribe-2評測：砍價72%，但語言表現不一 | MAI-Transcribe-2 Review: 72% Cheaper, Mixed Accuracy
- Google助理評測：9/4起停用，Gemini接管功能砍半 | Google Assistant Review: Shutdown Begins, Gemini Takes Over
AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends
留言
張貼留言