A seemingly harmless email can contain instructions meant for the AI assistant that handles, summarizes, or acts on your email. This is important as organizations start to connect AI tools like Microsoft Copilot to email, calendars, files, and collaboration tools.
Email Prompt Injection: The New Phishing Risk Hiding in Enterprise Inboxes
About this summary. This is a short, independently written summary of an article first published by Hornetsecurity. Cyber Security News did not report or verify the underlying story. Read the original: https://www.hornetsecurity.com/en/blog/email-prompt-injection/
Source attribution: headline and facts are from Hornetsecurity (hornetsecurity.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Salesforce Agentforce vulns allowed 0-click CRM data theft, anonymous phishing
Security flaws in Salesforce Agentforce allowed poisoned leads to hijack its AI agents, silently steal CRM data without requiring a click, and send phishing messages…
How device code phishing gives scammers access to your account
You receive an invitation to a password-protected meeting, a secure chatroom, or a shared document. To get access, it says, you need to enter a short code on a sign-in…
Fake Claude Max giveaway tricks users into handing over their Google account credentials
A fake Claude Max giveaway uses a spoofed Google sign-in window to steal users’ login credentials, Malwarebytes researchers have found. “Browser-in-the-browser” is not a…
OAuth Token Theft Through Microsoft's Front Door | Huntress
A sideloaded package turns a Microsoft-signed binary into an OAuth token theft tool. No phishing domain, no spoofed UI, no browser. Here's how to detect it.
Fake Claude Max giveaway hides a Google account phishing trap
Phishing follows whatever people want at the moment, and right now that includes AI subscriptions they don’t have to pay for. We recently uncovered a new variation on…
AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft
The cybercrime platform leveraged AI at every step of the attack chain, including writing social engineering messages and deciding targets.