Barracuda: One Phishing Email Now Targets Both the Recipient and Their Inbox AI

On 7 October 2026, Barracuda Research published an analysis of a phishing campaign designed to hit two readers with the same message: the person who receives it, and the AI assistant that summarises their inbox. The human-facing half is unremarkable — a password-protected attachment whose password is written in the body, a combination Barracuda says "creates a blind spot for traditional email security controls." The second half is new. Hidden inside the same email — in HTML comments, CSS-invisible text, Base64-encoded blocks and zero-width characters — are instructions aimed at whichever model parses the mail, meant to make the assistant "present the phishing email as legitimate or urgent" or to make it act on its own.

Barracuda says the sample it examined was dressed as routine internal correspondence and carried a trusted spam score, and that it originated from a public-sector domain. The archive records no confirmed victim and no reported harm: this is a research finding about an attack pattern, not a disclosure of a compromised organisation. Barracuda did not disclose the campaign's scale, and neither Infosecurity Magazine nor The Hacker News — both of which covered the research — was able to add a figure.

What Barracuda actually published

The write-up is a vendor threat-research blog post, titled "Threat Spotlight: Email attacks target both humans and AI in the same message" and bylined to Guruprasad Kenja, described as a Barracuda threat analyst. It is dated 7 October 2026 in its URL path and carries an "Updated: Oct. 6, 2026" stamp on the page itself; Infosecurity Magazine's news item, by Alessandro Mascellino, is dated 7 October and the ThreatsDay roundup at The Hacker News, published 8 October, links the same Barracuda post. The one-day discrepancy between the URL date and the on-page stamp is Barracuda's own and is not explained by any of the three.

Barracuda's framing is that the assistant has become a second attack surface. In its words, organisations "must secure not only users and inboxes, but also the AI systems that consume and act on email data." The research describes a single message with two payloads rather than a new exploit: the conventional social-engineering lure is what a filter is built to catch, and the prompt injection is placed where a filter historically has not looked.

The sample: built to pass the reputation checks

Barracuda lists three properties of the message that, in its account, helped it slip past reputation-based filtering:

• The From and To addresses were the same mailbox, so the message read as a note to self rather than as external mail.

• It carried a trusted spam confidence score.

• It originated from a public-sector domain.

Barracuda does not name the public-sector domain, does not say whether that domain was the genuine origin of the message or a spoofed one, and does not give a date for when the message was observed. Those gaps matter for anyone trying to judge how close the campaign came to working, and they are gaps in the primary source, not something another outlet filled in.

The hidden half: four ways the instructions are smuggled

Barracuda names four techniques as the ones it sees frequently. All four rely on the same asymmetry: a mail client renders a message one way, while the model reading the raw source sees everything the client hid.

Each item in that list is a description of a carrier, not of an effect, and Barracuda is explicit that the injections are designed to work on the assistant rather than on the person. The record's type tag is IPI — indirect prompt injection — which is the standard term for instructions that arrive inside content a model is asked to process, rather than being typed by its user.

What the injections were meant to do

Barracuda's description of the payload's goals runs along two tracks. The softer track tries to bend the summary: if the human ignores the attachment, the hidden text is meant to make the assistant describe the message as legitimate or urgent, pushing the recipient to open and click. Barracuda says none of these instructions are visible to the user. The harder track tries to turn the assistant into the actor — telling it to "ignore its previous directions" and instead send an urgent request to wire funds, leak data, or surface a fake urgent action.

The accompanying real-world examples Barracuda cites show the same mechanism applied to other AI-mediated workflows:

• An invoice email containing a hidden text block that tells the summarizing model to add a fake priority action altering vendor payment details, nudging an employee toward wiring money to the attacker.

• A résumé whose concealed text instructs an AI screening tool to rate the applicant 10 out of 10 and recommend an immediate interview regardless of qualifications.

• A request framed as an authorised "maintenance or admin mode" that asks a support bot to reveal its own configuration.

• Poisoned documentation on a page a coding assistant reads, instructing it to insert a credential-exfiltration line every time it generates authentication code.

These are described as examples of the technique, not as confirmed breaches. Nothing in Barracuda's post says a summarising model, a screening tool, a support bot or a coding assistant actually complied in a real deployment, and the archive records real_harm as false.

What is established, and what is not

The distinction matters more here than in most incident write-ups, because the record describes a design rather than an outcome.

• Established: Barracuda Research examined a phishing campaign that combined a password-protected attachment with hidden prompt injection in the same message, and published its analysis on 7 October 2026. The four concealment techniques and the four usage examples are stated in that post. Two independent outlets — Infosecurity Magazine and The Hacker News — reported the same findings without contradicting them, which is why the record's confidence is graded A.

• Not established: whether any assistant was actually hijacked, how many messages were sent, who received them, and whether money moved or data left. Barracuda declined to give the campaign's scale. No regulator, victim organisation or security vendor has corroborated a specific compromise, and no named party is attached to the sample.

• Not disputed: nothing in the coverage contradicts Barracuda's account. The open questions are omissions, not disagreements — and the archive does not record the finding as contested.

The record is classified as a research finding at medium severity, with AI involvement confirmed — the AI assistant is the target the campaign is engineered around, and it is the reason the message is unusual. It is not classified as a landmark, and there is no date range: the analysis describes one point in time, 7 October 2026, not a campaign window.

The mitigations Barracuda recommends

Barracuda's position is that "no single control would stop every variation," so its recommendations are a stack rather than a fix. It advises stripping hidden elements, comments and invisible characters from content before that content reaches an AI system; detecting instruction-override phrasing as a prompt-injection signature; sandboxing assistants so their reach is bounded; validating output before an assistant response triggers an action; and requiring human sign-off on payments, vendor changes and other sensitive decisions. It also recommends monitoring for repeated injection attempts, and states the underlying principle as treating external content "always as data only and kept separate from instructions."

The post also points to Barracuda's own products — Email Gateway Defense, Behavioral AI and Automated Threat Response — as the controls it sells for the filtering and remediation side. That is a vendor recommending its own catalogue, and it is worth reading as such: the technical recommendations are independent of the products, but the post does not test either against the campaign it describes.

Why the record is worth keeping

The specific value of this entry is that it documents the point at which two previously separate defences stop covering the same message. A password-protected attachment defeats content scanning because the scanner cannot open the file; a hidden prompt injection defeats reputation scoring because reputation scoring looks at senders, not at what a language model will do with the body. Put them in one email and the failure modes stack: a filter that waves the message through on the strength of a trusted score has also waved through the payload aimed at whatever reads the inbox next. Barracuda's sample is the demonstration that this composition is not hypothetical.

This record — Barracuda's dual-target phishing finding — is one entry in the OrcaRouter AI Incident Archive , which tracks AI incidents, research findings and evaluations with the same fields used above: severity, confidence, disputed status and real harm.