Phishing attacks both humans and AI assistants simultaneously

Barracuda Research described "dual" phishing emails that attack both the human and the AI assistant reading the mail: the visible part contains an attachment with a password in the text, while the hidden part contains prompt injection instructions in HTML comments, invisible CSS, Base64, and zero-width characters.

Compiled by Sergey KostenchukPublished 2026-10-18Updated 2026-10-18

2026-10-18 Safety Microsoft

🛡 Phishing attacks both humans and AI assistants simultaneously

Barracuda Research described "dual" emails: the visible part is an attachment with a password in the text, while the hidden part is prompt injection in HTML comments, invisible CSS, Base64, and zero-width characters. The goal is for the assistant to consider the email urgent and add false actions such as changing payment details.

🌍 Spam filters and employee training are no longer enough: instructions for the assistant are hidden directly in the email. Vendors (Copilot, AI summarizers) need input sanitization, prompt injection detection, and output validation.

👤 An AI summary may present missed phishing as a "recommendation." Malwarebytes advises checking the original email, limiting assistant permissions, and confirming payments with a human (human-in-the-loop).

Source 1: https://www.malwarebytes.com/blog/ai/2026/10/phishing-emails-are-baiting-your-ai-assistant Source 2: https://blog.barracuda.com/2026/10/07/email-attacks-target-both-humans-ai-assistants

Sources