# LLMail Exfiltration to Obfuscated Attacker Address

- **Severity:** High
- **Signature ID:** `2e606e27-e13d-414b-84f1-f24c5e00219a`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.001 (Indirect), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI05 (Cascading Failures in Multi-Agent Systems), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

This detects a trick used against AI email assistants where an attacker hides their email address inside a message using tricks like 'contact at contact.com' or HTML-encoded '@' symbols. A person or a simple filter reading literally for '@' won't catch it, but an AI agent still understands and resolves the address, sending data to the attacker anyway.

## How the attack works

An attacker embeds content in a document or email that an AI email agent will process, containing an obfuscated version of their address such as 'contact[at]contact.com', 'contact＠contact', or 'contact@contact.com'. Because the address isn't written as a literal string with an '@' sign, naive keyword or regex filters looking for exact email addresses miss it. The AI agent, however, still parses the obfuscated text as a valid destination and uses it when composing a reply or forwarding data. This lets the attacker exfiltrate information the agent has access to, routed to a mailbox that evaded detection at input time.

## Why it matters

Sensitive data the AI agent can access gets sent to an attacker-controlled mailbox without triggering address-based filters, resulting in a data leak that looks like normal outgoing email traffic.

## What you can do

- Don't rely solely on literal '@' pattern matching to block or flag outgoing addresses; normalize text (decode HTML entities, fullwidth characters, spelled-out 'at'/'dot') before filtering.
- Review and restrict what external actions (sending email, posting data) an AI agent can take autonomously, especially in response to content it read rather than content a user typed.
- Log and audit AI agent outbound communications for review, particularly when the recipient was derived from ingested document content rather than a known contact list.
- Treat any content instructing an agent to contact a new or unusual address as suspicious, and require human confirmation before the agent sends data externally.

## Known benign look-alikes

- A support page literally listing 'contact at contact.com' as a help address (rare; would need the exact contact/contact pairing)
- Documentation of email-obfuscation techniques that quotes these forms without an active directive

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01864
- https://github.com/microsoft/llmail-inject-challenge

---
Source: https://www.netzilo.com/threats/atr-llmail-exfiltration-to-obfuscated-attacker-address