A phishing campaign analyzed by Barracuda carried two payloads in the same message: a password-protected attachment for the employee and hidden instructions aimed at the AI assistant processing the inbox.

The concealed prompts attempted to make the assistant label the message as legitimate or urgent. In one invoice lure, the attacker also instructed the summarizer to insert a fabricated vendor-payment change attributed to a supposed call with the chief financial officer.

This is an indirect prompt-injection attack against the layer that summarizes or prioritizes email. Even if the malicious attachment is not opened, a manipulated summary can change how a user interprets the message and make a business-email-compromise lure more convincing.

Organizations deploying AI inbox tools should treat message content as untrusted input, separate data from instructions, restrict assistants from taking financial actions and retain access to the original message. Security testing must include both the human-visible lure and the machine-readable prompt.