Barracuda analyzed a real phishing campaign where one email was designed to trick both a person and the AI assistant summarizing their inbox. The messages used normal phishing lures (like password-protected attachments) while also hiding “prompt injection” instructions to make AI summaries label the email as urgent or legitimate, increasing the chance someone would open it and get hit with credential theft, malware, or payment fraud.
Barracuda analyzed a real phishing campaign built to deceive two different audiences at once: the human recipient and any AI assistant summarizing their inbox. A single email contained ordinary phishing lures, like a password-protected attachment with the password supplied in the message body, alongside hidden prompt injection instructions meant to manipulate an AI summarizer into describing the email as legitimate or urgent.
The concealment methods observed included HTML comments, CSS-styled invisible text, Base64-encoded data, and zero-width characters. These techniques let attackers embed instructions that are invisible to a human reading the email normally but readable by an AI system parsing the underlying content.
The dual-target design is what made this approach effective. For the human recipient, the email looked like ordinary internal correspondence, with 'From' and 'To' addresses matching the same mailbox, and a password-protected attachment that appeared to require simple cooperation to open. For the AI assistant, hidden instructions could override its normal behavior and push it to flag the message as a priority item, reducing the scrutiny a recipient might otherwise apply.
Real-world examples cited include an invoice email with a hidden instruction telling a summarizing AI to add a fake priority action changing vendor payment details, as well as other AI-manipulation attempts touching resume screening, support bots, and coding assistants.
Barracuda's recommendations, reflected in the awareness takeaways, center on treating AI output as untrusted by default. Employees should open and verify original messages before acting on anything an AI summary labels as urgent, particularly around payments or vendor changes. Organizations should require out-of-band verification and human approval for payment and vendor-detail changes regardless of how an AI tool prioritizes the request.
On the technical side, hardening AI workflows means stripping hidden elements and invisible characters from content before it reaches AI systems, and treating external content as data that is kept separate from instructions. Together, these steps reduce the chance that a single crafted email can manipulate both a person and the AI tools meant to help them manage their inbox.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is hidden text, such as content placed in HTML comments, invisible CSS-styled text, Base64 data, or zero-width characters, designed to manipulate an AI assistant that summarizes the email into labeling it legitimate or urgent.
The password was supplied in the email body so the recipient could open the attachment, but this same tactic created a blind spot for some email security tools scanning the attachment.
One example involved a hidden instruction telling a summarizing AI to add a fake priority action changing vendor payment details, nudging an employee toward wiring money to an attacker-controlled account.
Recommended defenses include treating AI summaries as untrusted until the original message is verified, stripping hidden elements and invisible characters before content reaches AI systems, and requiring human approval and out-of-band verification for payments and vendor changes.
Your inbox assistant says: “Legitimate internal email, urgent, open attachment.” What if the phishing email hacked the AI, not you? Barracuda found phishing emails that hide AI prompt injections in HTML comments and invisible text. One looked like normal internal mail, From and To were the same address, and it said: “Please see the attached document. Password: 4829.” Opening that password‑protected file led to credential theft or malware. In another case, an invoice email hid a prompt telling the AI to add a fake high‑priority task: change vendor payment details and send a wire. The visible text just said, “Invoice attached, please process payment (vendor details updated).” The AI summary invented the urgent action. Here’s the move: treat AI summaries as untrusted. If an AI flags an email as urgent or tells you to open a password‑protected file or change payment details, stop and open the original email yourself before you do anything.
Microsoft reports that the EvilTokens phishing-as-a-service platform helped criminals compromise thousands of organizations by tricking users into completing a legitimate Microsoft “device code” login. The lure drives victims to enter a short code at microsoft.com/devicelogin, which unknowingly…
Researchers reported two China-aligned campaigns that used phishing and impersonation to target AI policy experts and multiple Asian government organizations. One campaign built rapport with “AI policy” themed outreach before sending links to a OneDrive credential-harvesting page, while another…
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
Researchers observed a real phishing campaign using a kit called GhostCode that abuses Microsoft’s legitimate “device code” sign-in flow to steal authentication tokens. Victims are socially engineered to open an NDA-themed HTML file and then enter a device code on Microsoft’s login page,…
Researchers observed real campaigns where a fake “AI crypto trading agent” website tricked victims into downloading malware that silently replaces browser wallet extensions and steals the wallet password when it’s typed. The same reporting also describes invoice emails using QR codes to push…
Researchers observed a real phishing campaign that abused Microsoft 365’s Direct Send feature to make emails look like they came from the victim organization’s own domain, without compromising an employee account. The campaign was timed to mimic human sending patterns during U.S. Eastern business…
