Barracuda Research published a threat spotlight on October 7, 2026 that changes how we should read the phrase “the email was addressed to someone.” Written by threat analyst Guruprasad Kenja, the analysis describes phishing campaigns in which a single message carries two separate attacks. One layer targets the human recipient with conventional social engineering. Another layer, invisible to the person reading the message, carries prompt injection instructions aimed at the AI assistant that summarizes, prioritizes, and increasingly acts on the inbox.
The researchers frame it plainly. Humans are targeted with tactics such as password-protected attachments, and AI assistants are targeted with prompt injections designed to influence or override user behavior. Organizations must now secure not only users and inboxes but also the AI systems that consume and act on email data.
How the dual-target email works
On the surface, the sample message Barracuda analyzed looks like ordinary internal correspondence. The From and To addresses match the same mailbox, the message carries a trusted spam confidence score, and it originates from a public sector domain, all of which lend it perceived legitimacy and help it pass reputation-based filtering.
The visible layer holds a routine-looking message with a document attachment. The attachment is protected with a password, and the password is conveniently provided in the email body, a combination Barracuda notes creates a blind spot for traditional email security controls, because encrypted attachments are hard to inspect. If the user opens it, the attack progresses to credential theft or malware delivery.
If the user overlooks the email, the second layer is waiting. Hidden instructions can make the AI assistant present the message as legitimate or urgent in its inbox summary, pushing the human to open the email and click after all. In other samples, the injected prompt tells the assistant to ignore its previous directions and instead send an urgent request to wire funds to a specified account, leak data, or surface a fake urgent action. None of these instructions are visible to the user.
Four techniques for hiding instructions from humans but not from AI
Barracuda identified four techniques that appear frequently in these attacks:
Hidden text in HTML comments. Instructions are tucked inside comment tags that never render in a mail client but remain in the raw source code that an AI parses.
Invisible text through CSS styling. Text rendered at zero-pixel font size, in white, or hidden entirely occupies no visible space yet still exists in the document a model reads.
Base64-encoded data. Instructions are buried inside encoded blocks, such as an image data string, that decode to text an automated pipeline may extract.
Zero-width characters. Invisible Unicode characters are layered with normal text to smuggle or obfuscate content.
The researchers also documented real-world variants beyond the inbox: a hidden block in an invoice email instructing the summarizing model to add a fake priority action changing vendor payment details, hidden text in a resume telling an automated screening tool to rate the candidate 10 out of 10 regardless of qualifications, a fake maintenance-mode request tricking a support bot into revealing its own configuration, and poisoned documentation on a web page instructing a coding assistant to insert a credential-exfiltration line every time it generates authentication code.
Where DMARC fits in this picture
The uncomfortable detail in Barracuda’s anatomy of the sample email is how much apparent legitimacy it carried. A trusted spam confidence score and a plausible public sector domain got it past reputation-based filtering. That is the exact weakness domain authentication exists to close. Reputation systems ask whether mail from this source looks OK. DMARC asks a harder question: does this message actually come from the domain in the From line, verified through SPF or DKIM alignment?
An enforced DMARC policy at p=reject does not stop a message sent from a compromised real mailbox, and Barracuda’s research shows attackers increasingly start from genuine infrastructure. But enforcement does remove the cheapest opening move, the spoofed exact domain that borrows your reputation to get past the first gate. Every dual-target email that has to come from a lookalike domain instead becomes easier to detect, more likely to be filtered before either the human or the AI assistant ever reads it, and visible in your aggregate reports from the first message.
There is a second, quieter benefit. Barracuda’s recommended defenses include treating external content as data only, never as instructions, and validating outputs before an AI action triggers. That only works if you know which mail streams are legitimately yours. Continuous DMARC monitoring gives you the ground truth of who is sending as your domain, so when your team reviews what an AI assistant was fed, the sending sources in your reports are known and accounted for.
What a defense actually looks like
Barracuda is explicit that no single control stops every variation, and recommends layered defenses: input sanitization that strips hidden elements, comments, and invisible characters before content reaches AI systems, prompt injection detection, sandboxing to limit what an assistant can access, output validation before AI responses trigger actions, mandatory human approval for financial transactions and vendor payment changes, and monitoring to spot repeated injection attempts. The message for senders and defenders is the same. Protecting the inbox is no longer enough, because the systems that read, summarize, and act on email now need protection too. Start with the foundation that never stops paying rent: SPF, DKIM, and DMARC enforcement across every domain you own, with aggregate reports someone actually reads.
Every dual-target attack still has to reach an inbox, and every spoofed message still leaves a trace in your authentication data. Excello Mail turns your DMARC, SPF and DKIM signals into a live view of who is sending as you, so suspicious sources surface before they reach your users or their AI assistants. Sign up for free to Excello Mail and see what your domain is telling the world.