ASCII smuggling exposes a deeper email trust problem
Hide an invisible Unicode character inside a word and a filter's keyword rule no longer matches, while the reader sees nothing odd. The real issue is that email is trusted before anyone verifies it.
The technique
ASCII smuggling hides invisible Unicode characters inside ordinary words. People can still read the text, but keyword rules, regular expressions and some machine learning systems cannot. The phishing email arrives and looks normal.
Jonathan Browning, executive director of content and engagement at The ChannelPro Network, examined a campaign that used it. Mailprotector Founder and CEO David Setzer explained why it points to a deeper problem: email often gets trust before anyone verifies who sent it or what it asks the recipient to do.
"If we're ever going to solve this problem, we have to flip the email's trust assumption. We've been fighting the wrong side of asymmetric warfare for too long."
David Setzer, Founder and CEO, Mailprotector
Can filters catch it?
Often, but not on content inspection alone. Microsoft reported that other layers, including sender reputation and authentication checks, still caught more than 99% of the campaign. Any new attack will likely have that last 1%, which is why email security should work alongside tools like ITDR or MDR.
Flipping the default
Email runs on an open protocol built to accept mail from strangers. Zero trust reverses that. Every message is untrusted until the sender, certificates, content and requested action can be verified, and mail that cannot clear the bar is not simply delivered.
Where Shield fits
Shield is Mailprotector's zero trust email security filter for Microsoft 365, blending a gateway with modern APIs. It verifies every email on multiple facets: trusted contacts, signatures, country of origin, content and more. No email is trusted just for looking legitimate. In X-Ray, a secure sandbox, users can see exactly what caused a block.