Phishing Emails Hide Prompt Injections to Manipulate AI Assistants

Barracuda researchers identified a phishing campaign combining conventional social engineering with concealed prompt injections aimed at AI assistants that summarize email. An analyzed message used a password-protected attachment and apparently trustworthy email signals to evade scrutiny, while hidden instructions could steer an assistant into describing the message as legitimate or urgent. Researchers identified HTML comments, CSS-hidden text, Base64-encoded data and zero-width characters as ways to conceal malicious instructions from human readers. The campaign’s prevalence was not disclosed.

The findings highlight how a single email can target both employees and the AI systems that read, summarize or act on their messages. Barracuda also described prompt-injection examples targeting payment workflows, résumé screening, support bots and coding assistants. Recommended defenses include sanitizing external content, separating it from trusted instructions, detecting instruction-override attempts, restricting and sandboxing AI access, validating outputs and monitoring activity. Sensitive financial actions should require human approval, with layered controls protecting both inboxes and connected AI workflows.