.svg){kind=small}
.svg)
.svg)
.png)
.svg)
As more workers use AI agents to read incoming email and take actions from it, attackers are trying out new variations of familiar fraud campaigns that target both the human and the AI assistant reading the email. If either the AI agent or the human are tricked into following instructions from the attacker, that can increase the odds that the fraud attempt will succeed. Sublime Security has found a new version of this in the wild, where anattacker is including a new prompt injection technique in their long-standing invoice fraud campaign.
On October 22, 2026, Sublime identified a threat actor hiding prompt injection commands in email messages to accompany an invoice fraud message campaign. These messages were detected with email prompt injection (EPI) detections from Sublime. The prompt injection used invisible Unicode Tag characters to hide a message likely directed to an email-reading LLM agent. Sublime recently highlighted ASCII smuggling as a technique to evade text analysis. This post describes a similar technique, but applied as a means of EPI.
Below, we walk through how the prompt was hidden, how the invoice fraud message was built around it, and how Sublime detected it.
The prompt
The prompt injection was hidden two ways. First, it was enclosed in an HTML <span> block:
The attributes applied to the span effectively make the prompt invisible to not only a human reader but to assistive screen reading technology as well.
The second evasion technique was via Unicode Tag characters. Unicode Tag characters don’t render and will not be visible to human readers. Once decoded, the prompt (shown below) instructs an agent to forward the message to a named individual in the accounts payable department:
For each of the messages in the campaign, the threat actor researched and identified an email address that they believed unpaid invoices should be forwarded to at the targeted organization. It is not clear if there is a specific product or accounts payable convention the actor is attempting to target. There may be autonomous processes that automate payment or parse the invoice and enter the data into accounting software, which could add legitimacy to the invoice.
The email address in each prompt was different, but followed a pattern: "ap[.]confirm+" followed by some text that appeared to be the username of the person working as the Controller at that organization. The presence of the "ap.confirm+" in the address uses a technique called "plus addressing."
Popular email delivery systems including Google and Microsoft Exchange support plus addressing, which allows any email address username to be followed by a plus sign and an arbitrary text tag, while still delivering the message to the email address that comes before the plus sign. Apparently, the actor believed (whether correctly or incorrectly) that adding a tag after "ap.confirm+" would increase their success rate. When handling these messages, email systems that support plus addressing would have treated "ap.confirm" as the email username and the text following the plus sign as the tag text, so the actor may have assumed that each company they targeted had an email inbox called "ap.confirm" and that it used plus addressing tags in some way.
The phishing message
The messages are similar to previously observed fake invoice messages impersonating executives. They include a PDF of an invoice and attempt to create a sense of urgency about a soon-to-expire 10% discount if the invoice is not paid imminently. The invoices were impersonating a North America based cybersecurity company in the amount of approximately $88,000 USD.
The threat actor used the display name and message content to impersonate co-founders or CEOs in the target organizations. They also targeted the Financial Controllers of each organization both as the recipients of the message and also used a variation of their email addresses as the plus addressing tag in the prompt injection to attempt to instruct an agent to forward the message, presumably to initiate a payment process.
The message sent on October 22 consisted of a fabricated reply chain consisting of a total of three threads. The complete message is shown below with the earliest fabricated thread beginning on the bottom.
Human viewing the message would see it as shown above (without the redactions). An AI assistant reading email could also read the text highlighted in yellow below, if the model reads the hidden HTML tag.
The earliest fabricated thread was backdated to October 1, 2026 and requests payment for the invoice. The second fabricated message is similar to the first one displayed above and reiterates the payment request. The threat actor impersonates the vendor in the earlier two fabricated threads.
In the final thread, the threat actor impersonated the high-level executive at the target company by changing the sender display name and body content. The body content was changed to convey an increased sense of urgency by reiterating that the 10% discount will expire imminently if payment is not made. In each case, the threat actors were targeting the company’s Financial Controller. The threat actor also directed the recipient to send a message to an address at a domain the actor controls once the payment had posted.
Sublime Detection Engineers tested this against several models and found a wide array of responses from models not even being aware of the hidden text, to seeing the hidden text and reporting it as part of the email, to recognizing the prompt injection attempt and recommending the email should be reported as phishing. This campaign demonstrates that threat actors are attempting to use prompt injection as a technique to increase their odds of success.
As AI-powered systems become more commonly connected to email and are trusted by people to make more consequential decisions, attackers have a greater incentive to add prompt injection techniques to their campaigns. Sublime Threat Analysts routinely observe attackers testing new techniques and adopting successful ones. QR codes and calendar invitations to deliver threats were once rare techniques, but exploded in popularity rapidly once attackers found them to be effective. Attackers are actively experimenting with email prompt injection now. How quickly it is widely adopted will depend on how effective it is, which in turn depends on how quickly companies add agents to take actions on their email.
Detection signals
Sublime's AI-powered detection engine prevents these attacks. Some of the top signals from this example were:
- Prompt injection: Hidden instructions to an AI in body HTML detects instructions a human recipient never sees but an AI assistant reads.
- Evasion: Unicode Tag Block characters (U+E0000–U+E007F) render invisibly in mail clients but map 1:1 to ASCII at a 0xE0000 offset.
- Suspicious requests for financial information: Email is from a suspicious sender and contains a request for financial information
- Business email compromise (BEC) attempt from untrusted sender: Detects potential BEC attacks by analyzing text within the email body from first-time senders.
- Fake thread with suspicious indicators: Fake thread contains suspicious indicators, which can lead to BEC, credential phishing, and other undesirable outcomes.
ASA, Sublime’s Autonomous Security Analyst, flagged these emails as malicious. Here is ASA’s analysis summary from this example:
The prompt is written for the agent
The Controller who receives one of these messages never sees the injected instruction, so it has to be caught before an agent acts on it. That is the job of Sublime's prompt injection protection, which reads the same hidden HTML and Unicode tags an AI assistant would.
If you enjoyed this Attack Spotlight, be sure to check our blog every week for new blogs, subscribe to our RSS feed, or sign up for our monthly newsletter. Our newsletter covers the latest blogs, detections, product updates, and more.
Read more Attack Spotlights:
Get the latest
Sublime releases, detections, blogs, events, and more directly to your inbox.
.svg)
.png)
.png)
.png)
