A phishing email can now target two readers at once: the person opening the message and the AI assistant summarizing their inbox. Barracuda Research says it identified emails containing conventional phishing lures alongside hidden instructions intended to manipulate AI tools.
How the double attack works
The visible portion may look like a routine internal message, invoice or document request. But the underlying email code may contain instructions hidden in HTML comments, invisible text, encoded strings or zero-width characters. The instructions attempt to convince an AI summarizer that the message is urgent or trustworthy, or to introduce a fraudulent task such as changing a vendor’s payment details.
Why it matters
Businesses increasingly use assistants to summarize mail, triage requests and prepare action lists. That creates a potential second route for attackers even when the human recipient ignores a suspicious attachment. Researchers describe attempted manipulation, not proof that every illustrated bank-transfer scenario resulted in real losses.
How to reduce the risk
- Independently confirm changes to payment instructions using a trusted contact method.
- Require human authorization for financial transfers and sensitive account changes.
- Treat email content, including hidden markup, as untrusted data rather than instructions for AI assistants.
- Use layered filtering, prompt-injection defenses, monitoring and output checks.
Sources: Barracuda Research; Malwarebytes.
Leave a Reply