Spammers adopt invisible Unicode block for ASCII smuggling

A segment of the Unicode standard that contains invisible characters—most notably the zero‑width space (U+200B), zero‑width non‑joiner (U+200C), zero‑width joiner (U+200D) and related markers—has moved from obscurity to widespread use across digital platforms. Originally introduced to support complex scripts and fine‑tune text layout, these code points produce no visible glyph, making them useful for formatting but also for embedding hidden information without altering the appearance of a document or message.

In recent months the invisible characters have been adopted for a variety of purposes, from covert tagging in social‑media posts and search‑engine optimization tricks to evading automated content filters and embedding tracking data in plain‑text files. Security researchers have documented their use in phishing emails, where the characters can split URLs or alter the visual order of text to mislead recipients, as well as in malware code that obfuscates malicious payloads. As the practice spreads, experts warn that detection tools will need to account for these non‑printing symbols to maintain the integrity of online communication and protect users from hidden threats.