Medium Severity

Attachment: Suspicious use of Unicode tag characters in ICS File

Labels

BEC/Fraud

Credential Phishing

Description

Unicode Tag Block characters (U+E0000–U+E007F) render invisibly in mail clients but map 1:1 to ASCII at a 0xE0000 offset. Attackers use them two ways: to smuggle hidden instructions that LLM-powered email assistants will read and act on, and to interleave invisible characters through visible text to defeat content matching. This rule flags either use in the subject, body, or a calendar attachment, discounting the England, Scotland, and Wales subdivision flag emoji, which are legitimately built from tag characters.

References

https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/

https://embracethered.com/blog/posts/2024/hiding-and-finding-text-with-unicode-tags/

Sublime Security

Created Oct 4th, 2026 • Last updated Oct 4th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(filter(attachments,
               .file_type == "ics"
               or (
                 .file_extension == "ics"
                 or .content_type in ("application/ics", "text/calendar")
               )
        ),
        regex.count(file.parse_text(.).text, '[\x{E0020}-\x{E007E}]') > 10
        and (
          regex.contains(file.parse_text(.).text,
                         '[A-Za-z0-9][\x{E0020}-\x{E007E}]+[A-Za-z0-9]'
          )
          or regex.contains(file.parse_text(.).text,
                            '[\x{E0020}-\x{E007E}]{10,}'
          )
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.