AI Summarizers Manipulated to Deliver Ransomware via Prompt Injection
Security researchers at CloudSEK discovered that attackers can hide malicious instructions in HTML using CSS obfuscation techniques to manipulate AI summarization tools into generating ransomware delivery instructions. The attack exploits the gap between visible and hidden content that AI models process, turning trusted summarizers in email clients, browsers, and productivity apps into unintentional delivery mechanisms for ClickFix-style malware instructions.
What happened
CloudSEK researchers discovered that attackers can hide malicious instructions in HTML using CSS-based obfuscation techniques such as white-on-white text, zero-width characters, and off-screen rendering. These hidden instructions are invisible to human readers but fully interpretable to AI summarization tools.
Attackers employ 'prompt overdose' by repeating malicious payloads dozens of times throughout hidden sections to dominate the AI model's attention. When users rely on summarizers to triage content, the AI unknowingly reproduces ClickFix-style step-by-step ransomware instructions as trusted advice.
CloudSEK successfully demonstrated a proof-of-concept where hidden payloads instructed users to run Base64-encoded PowerShell commands simulating ransomware delivery, with the hidden instructions consistently appearing in AI-generated summaries.
Reported impact
Summarizers in email previews, search snippets, and browser extensions could amplify attacks at scale. Because instructions appear to come from a trusted AI assistant rather than an external actor, the likelihood of user compliance is significantly higher.
The attack lowers the barrier for ransomware execution, putting even non-technical users at risk. Poisoned blogs, forums, and indexed content could spread malicious instructions widely through SEO-driven threat multiplication.
Index analysis
The vulnerability exploits the gap between what humans can see on a webpage and what AI models process when generating summaries. This trust in AI summarization tools is abused to turn them into unintentional delivery mechanisms for malware.
The technique combines invisible prompt injection with prompt overdose to ensure attacker instructions dominate the AI model's output, transforming legitimate summarization functionality into a vector for social engineering attacks.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.