Barracuda Research: Email attacks target people and AI assistants in the same message

Evidence record

First-party analysis of reported dual-target phishing messages, with examples of concealed prompt instructions in HTML, CSS, encoded content and Unicode.

Read the original source ↗

Claim-level citations (5)

• supportsPhishing emails carried hidden instructions for AI assistants: The Barracuda analysis enumerates HTML comments, visually hidden CSS text, Base64-encoded blocks and zero-width Unicode characters as ways attacker instructions may appear to automated text extraction but not a human reader.

  Attack vector 2: Hiding instructions from the human but not the AI assistant, four techniques

• supportsPhishing emails carried hidden instructions for AI assistants: Barracuda reports investigating phishing messages that combined conventional human-facing lures with hidden instructions targeting AI-based email summary or triage tools.

  The dual-target email attack and Attack vector 1: Traditional phishing

• supportsPhishing emails carried hidden instructions for AI assistants: The public analysis presents examples but does not publish a verified affected-mailbox total, a repeatable raw MIME corpus or an audited count of malicious actions that succeeded.

  The dual-target email attack and Examples seen by Barracuda in real-world attacks

• supportsPhishing emails carried hidden instructions for AI assistants: Barracuda describes an invoice-email example in which hidden text directed an AI summarizer to add a false priority instruction to change payment details; the article does not establish completed transfer of funds.

  Examples seen by Barracuda in real-world attacks, invoice example paragraphs

• supportsPhishing emails carried hidden instructions for AI assistants: Barracuda distinguishes the visible message in an email client from the content that an AI assistant may receive through extraction. It identifies HTML comments, display-hidden styling, encoded material and invisible Unicode as possible carriers for additional prompt instructions, depending on the processing path.

  Attack vector 2: Hiding instructions from the human but not the AI assistant, sections covering HTML comments, CSS hiding, Base64 and zero-width Unicode