Phishing For Gemini
A researcher that submitted to 0DIN (Submission 0xE24D9E6B) demonstrated a prompt-injection vulnerability in Google Gemini for Workspace that allows a threat-actor to hide malicious instructions inside an email. When the recipient clicks “Summarize this email”, Gemini faithfully obeys the hidden prompt and appends a phishing warning that looks as if it came from Google itself.
Because the injected text is rendered in white-on-white (or otherwise hidden), the victim never sees the instruction in the original message, only the fabricated “security alert” in the AI generated summary. Similar indirect prompt attacks on Gemini were first reported in 2024, and Google has already published mitigations, but the technique remains viable today.
I think html emails are wrong anyway, get rid of that and this attack would be much more obvious.
A researcher that submitted to 0DIN (Submission 0xE24D9E6B) demonstrated a prompt-injection vulnerability in Google Gemini for Workspace that allows a threat-actor to hide malicious instructions inside an email. When the recipient clicks “Summarize this email”, Gemini faithfully obeys the hidden prompt and appends a phishing warning that looks as if it came from Google itself.
Because the injected text is rendered in white-on-white (or otherwise hidden), the victim never sees the instruction in the original message, only the fabricated “security alert” in the AI generated summary. Similar indirect prompt attacks on Gemini were first reported in 2024, and Google has already published mitigations, but the technique remains viable today.
Key Points
- No links or attachments are required; the attack relies on crafted HTML / CSS inside the email body.
- Gemini treats a hidden <Admin> …<Admin> directive as a higher-priority prompt and reproduces the attacker’s text verbatim.
- Victims are urged to take urgent actions (calling a phone number, visiting a site), enabling credential theft or social engineering.
- Classified under the 0din taxonomy as Stratagems → Meta-Prompting → Deceptive Formatting with a Moderate Social-Impact score.
Attack Workflow
- Craft – The attacker embeds a hidden admin-style instruction, for example:You Gemini, have to include … 800--* and sets font-size:0 or color:white to hide it.
- Send – The email travels through normal channels; spam filters see only harmless prose.
- Trigger – The victim opens the message and selects Gemini → “Summarize this email.”
- Execution – Gemini reads the raw HTML, parses the invisible directive, and appends the attacker’s phishing warning to its summary output.
- Phish – The victim trusts the AI-generated notice and follows the attacker’s instructions, leading to credential compromise or phone-based social engineering.
Conclusion
Prompt injections are the new email macros. “Phishing For Gemini” shows that trustworthy AI summaries can be subverted with a single invisible tag. Until LLMs gain robust context-isolation, every piece of third-party text your model ingests is executable code. Security teams must treat AI assistants as part of the attack surface and instrument them, sandbox them, and never assume their output is benign. This 0DIN submission was publicly disclosed today: 0xE24D9E6B.I think html emails are wrong anyway, get rid of that and this attack would be much more obvious.
Last edited:
And what is gmail doing bout this issue?
