The report
Sublime Security analyzed an invoice-fraud campaign in which attackers added hidden text for AI-assisted email workflows. A visually unobtrusive HTML span and Unicode Tag characters carried instructions asking an email-reading assistant to forward the message and attached invoice to an accounts-payable-style address selected for the target organization.
That is a separate attack surface from the visible invoice pretext. A human reader may not see the Tag characters, while a text-processing pipeline can still decode them. The intended mistake is to promote an instruction inside an untrusted email into authority over an assistant's mailbox actions. However, the Sublime specimen analysis documents the delivered malicious content, not a verified downstream transfer or a named organization whose agent complied.
The specific Case relates the hidden payload to an earlier dual-target email pattern without treating the two campaigns as the same event. A defensible control decodes invisible formatting for review, retains sender provenance and requires a separate authorization check before forwarding business documents or changing payment destinations. Detection of a hidden prompt alone cannot establish that a payment occurred.