Ghost Ink

Unicode Tags steganography · U+E0000–U+E007F

A block of Unicode called Tags encodes letters that computers read but people can’t see. This lab hides a message in that invisible layer — and shows you how to catch it.

This sentence carries a hidden message. Nothing looks wrong.

Hide a message

Your secret becomes invisible tag characters tucked into ordinary text.
Output appears here — it will look identical to the cover text.

Find a message

Paste text that may carry Ghost Ink. The hidden layer is pulled back out.
Recovered message appears here.

Inspect & clean

The defensive side. X-ray any text for hidden or deceptive characters — not just Ghost Ink’s Tags block, but the whole family attackers use — then strip them out. This is how a filter, or a careful reader, defeats the trick.
Load an example:
Nothing inspected yet.

What just happened

Unicode reserves a block called Tags from U+E0000 to U+E007F. Almost all of it mirrors plain ASCII: U+E0041 stands in for “A”, U+E0061 for “a”, U+E0020 for a space. The characters exist in the text and travel with it, but fonts render them to nothing, so a person sees only the cover text.

  1. Your secret is turned into bytes, then Base64 so every character lands in the printable ASCII range.
  2. Each of those characters is shifted up by 0xE0000 into the Tags block — same letter, now invisible.
  3. The invisible run is appended to (or scattered through) the cover text. Position doesn’t matter: a reader collects the tag characters in order and shifts them back down.
Container format. Before Base64, the payload is one version byte, one flags byte (plaintext or AES-GCM), then either the UTF-8 message or salt(16) · iv(12) · ciphertext. With encryption on, the key comes from your passphrase via PBKDF2-SHA256 (210,000 iterations) and the message is sealed with AES-256-GCM in your browser — no bytes leave the page.

How attackers use this in the wild

This is not a party trick. The exact carrier this page demonstrates — the Unicode Tags block — is a live technique known as ASCII smuggling. It has had two lives, and a user’s suspicions are never raised in either one.

Life one · against AI

Smuggling instructions into a model

Malicious instructions are written in invisible tags and pasted into an email, a web page, or a document an LLM will process. The model reads the hidden commands as ordinary text; the human reviewing the same content sees nothing. This is a stealthy form of prompt injection, and it’s where the technique first drew attention.

Life two · against filters

Obfuscating keywords from a detector

Spammers slip invisible tags inside trigger words so a filter no longer recognizes them, while the recipient reads the word normally. Same mechanism, inverted goal: instead of adding a hidden instruction, they’re hiding a visible keyword from the machine that scores it.

In early 2026, Microsoft watched the second use explode. Daily hits on its ASCII-smuggling detection signature in Microsoft Defender for Office jumped from a low baseline of roughly 21,000 a day to more than 1.3 million on a single day in early February, and to 2.5 million within four days. The bulk of it was finance-themed spam — fake pre-approvals for credit lines and “bridge funding.”

~21K
signature hits per day, pre-onset baseline
2.37M
peak daily hits, Feb 11, 2026
~113×
jump from baseline to peak
3+ mo.
campaign ran Feb 9 → mid-May
Daily worldwide hits on the ASCII-smuggling signature around onset, Feb 2–16, 2026. Data: Microsoft, via Ars Technica.

The email angle is subtler than plain hiding, and it is aimed squarely at machine-learning classifiers. A word like funding is a clean, familiar unit to a model’s tokenizer. Slip an invisible U+E0020 into the middle and the tokenizer may split it into fun and ding, or emit rare tokens the model has never weighted — while the recipient still reads “funding.” The lure survives; the filter’s view of it does not. Want to see it? Load the spam lure in the Inspect & clean panel above and X-ray it.

“Because tag characters are invisible to humans but exist at the text-processing level, the same property that makes them useful for smuggling instructions into a model also makes them useful for obfuscating keywords before a detector evaluates them. The intent is inverted, but the mechanism is similar, and a user’s suspicions are not raised.” — Microsoft, quoted by Ars Technica, Sept. 2026

Camouflaging trigger words isn’t new — spammers have leaned on zero-width and non-breaking spaces for decades to break literal-string matches. What’s new is the target. The bigger prize is no longer defeating a keyword search; it’s defeating the ML- and NLP-based models that now drive spam and phishing classification. Unless a filter renders the message to an image and runs OCR over it, the invisible tags can quietly change what the model “reads.”

Reporting and figures drawn from Dan Goodin, “Once popular for attacking AI, ASCII smuggling is embraced by spammers,” Ars Technica, Sept. 4, 2026, which is based on research published by Microsoft. This page is an independent educational demo and is not affiliated with either.

Where this is weak

Real primitives, no simulated math. Crypto via WebCrypto SubtleCrypto. Everything runs client-side.