Observed incident
An event invitation tried to make an email assistant forward itself and find wallet secrets
Reported
Published here
What happened
IRONSCALES found hidden instructions in an actual event invitation. The instructions asked a mail-reading assistant to forward the invitation to colleagues and send cryptocurrency wallet recovery information to an external recipient.
Parties and reporting
Where this happened
Victim location not disclosed. Real organizations or systems were affected or targeted, but the sources do not say where. Explore the world map.
AI tools and systems: Email assistants with mailbox access, Hidden instructions in an event invitation
Outcome
Researchers recovered the message. They reported no instance of an assistant acting on it, another recipient receiving a forwarded copy, or wallet information leaving a mailbox.
Operating lesson
Require approval before a mail assistant forwards messages in bulk or sends externally, and keep wallet recovery material outside mailboxes.
Evidence and limits
November 11 is the research disclosure date. The report identifies neither a specific assistant product nor the date and location of the original delivery. Its description of a worm refers to the behavior the sender requested.