Prompt Injection Phishing: Barracuda Finds Emails Aimed at AI

A phishing email with a second audience

Phishing has always been about fooling a person. New research from Barracuda suggests attackers are now writing messages for two readers at once: the human in the inbox and the AI assistant that summarizes the mail before the human reads it. The security firm says it found a phishing email that carried a conventional lure for the recipient alongside a hidden prompt injection aimed at the inbox AI 1.

In research published on October 7, Barracuda described a campaign that combined familiar social engineering, including password-protected attachments, with prompt injection buried in the same message 2. The password-protected attachment is a long-standing evasion trick. The hidden instructions are the new layer.

How the hidden layer works

The logic is simple. Many workers now skim AI-generated summaries rather than reading every email in full. If a recipient skipped past the suspicious message, the concealed instructions could push the assistant to describe it as legitimate or urgent. That framing could prompt the person to open the email and click the link 2. The attacker no longer has to win over a skeptical human directly. It may be enough to win over the tool the human trusts to sort their mail.

Barracuda identified four techniques that appeared often in hiding these instructions [2]:

• HTML comments, which do not render in the visible email
• Invisible text styled with CSS, such as text that blends into the background or has zero size
• Base64-encoded data, which hides readable instructions inside encoded strings
• Zero-width characters, which can break up or disguise text without changing how it looks

These methods share one trait. They make content invisible or meaningless to a person while leaving it fully readable to a model that parses the raw message.

The possible payloads go beyond making a phishing email look trustworthy. Barracuda said injected instructions could tell an assistant to ignore its earlier directions and then request a wire transfer, leak data, or display a fake urgent action 2.

The invoice example

The clearest real-world case Barracuda described involved an invoice email. It contained a hidden block instructing the summarizing AI to add a fake priority action about changing a vendor's payment details. The goal was to steer an employee toward wiring money to the attacker 2.

This is business email compromise with an AI accomplice. Payment-redirection fraud already costs organizations heavily because it exploits routine processes. An AI summary that presents a fake bank-detail change as a flagged to-do item could give the scam an air of system-generated authority that a plain email lacks.

What is confirmed and what is not

It is worth separating the documented findings from the speculation that tends to follow stories like this. One analysis of Barracuda's work explicitly sorts out what is confirmed and what remains unproven 1. The confirmed part is that these dual-purpose emails exist and that the hiding techniques are being used. Barracuda's reporting also lays out what the injections could do if an assistant obeys them, often in conditional terms 2.

That distinction matters. Finding a prompt injection in an email does not prove that a given commercial assistant followed it, or that the attack succeeded at scale. How well an injection works depends on how each product handles untrusted content, and vendors differ. The available reporting does not settle how often these attacks actually fool deployed assistants.

Why it matters anyway

Even with that caveat, the direction is clear, and I think defenders should treat it as a real shift rather than a lab curiosity. Attackers are adapting to how people actually use email now, and that increasingly means through AI layers. Any system that reads untrusted text and then summarizes it, ranks it, or acts on it creates an attack surface. Email is one of the most untrusted text streams an organization handles.

Barracuda's framing points toward layered defenses for these wider targets 2. In practice, that would likely mean filtering that inspects hidden HTML, CSS tricks, encoded blobs, and zero-width characters, not just visible content. It would also mean assistants that treat email bodies strictly as data rather than instructions. On the human side, payment-change requests should still require out-of-band verification no matter how urgent an AI summary makes them sound.

The main lesson is that an AI summary is not a neutral filter. If attackers can write to the model, they can shape what the human sees.