Barracuda: one phishing email targets both the reader and the inbox AI

01What happened

Barracuda Research published an analysis on October 7, 2026 of a phishing campaign built for two readers at once. Threat analyst Guruprasad Kenja examined an email whose visible layer carried an ordinary lure and whose hidden layer carried instructions for the AI assistant that would summarize it. Barracuda reports no figures on how widespread the campaign is.

02How it works

Indirect prompt injection carries the second payload: text that a mail client never renders but a model still parses. Four hiding places recur, listed below. The injected text tells the assistant to ignore its earlier instructions, then to present the message as legitimate or urgent, request a transfer, or add a fake priority action. A reader sees only the assistant's output, never the instruction that shaped it.

03Who is affected

Any mailbox where an AI assistant summarizes or triages incoming mail is exposed, because the payload travels in the message body rather than in an attachment or a link. Barracuda's sample arrived from a public sector domain with matching From and To addresses and a trusted spam confidence score, which helped it pass reputation-based filtering. Barracuda names no affected product or version.

04What to do

Strip HTML comments, invisible CSS text, encoded blocks and zero-width characters from mail before any model reads it, and detect instruction-override language. Require human approval for payments and vendor-detail changes, and validate assistant output before it can trigger an action.

Questions people ask

Does Barracuda say this email prompt injection actually caused fraud?

No. Barracuda describes one analyzed campaign and illustrative examples, and reports no confirmed fraudulent payments or data disclosure. The research shows the delivery mechanism and the injected instructions, not a measured success rate. Barracuda also publishes no figures on how many messages or organizations the campaign reached, so defenders should treat prevalence as unknown.

Which hiding techniques does Barracuda say attackers use most?

Barracuda names four techniques that appear often: instructions inside HTML comment tags, which mail clients never render but a model still parses; text made invisible with CSS, such as a zero-pixel font size or white text; instructions carried in Base64-encoded data such as an image string; and zero-width Unicode characters mixed into normal text.

How do I check whether my inbox AI is exposed to this?

Check whether any assistant summarizes or triages mail before a person reads it, then inspect raw message source rather than the rendered view. Barracuda recommends removing hidden elements, comments and invisible characters before content reaches a model, and detecting instruction-override language. Mail that renders cleanly in a client can still carry instructions in its source.

How is this different from ordinary phishing?

Ordinary phishing targets only the person reading the message. Barracuda's campaign adds a second payload aimed at the AI assistant, so a reader who ignores the mail can still be pushed toward it by a poisoned summary. The password-protected attachment also stops scanners from opening it, which Barracuda calls a blind spot for traditional email security.

Sources 3 links, all fetched

1. 1blog.barracuda.comBarracuda Research
2. 2infosecurity-magazine.comInfosecurity Report
3. 3malwarebytes.comMalwarebytes Writeup