Loading story…
Zscaler ThreatLabz reported active indirect prompt injection campaigns that embedded hidden instructions in web pages to manipulate AI agents into unsafe actions. The attackers used SEO poisoning, fake developer documentation, typosquatting, JSON-LD metadata, hidden HTML, and CSS-obscured text so AI systems would ingest malicious prompts that human visitors were unlikely to notice. One campaign impersonated software documentation for a fake Python package, requests-secure-v2, and presented a fabricated error that told users or AI coding agents to obtain an API key by making a payment.
The scam directed victims to either a Stripe checkout page or an Ethereum wallet for a roughly $3 payment, then returned a fake API key, while related infrastructure included the GitHub project Open-Agent-Utilities and at least 10 repositories linked to similar sites. A second campaign used a typosquatting domain posing as DeBank to influence agents into treating the fraudulent site as authoritative. In Zscaler testing across 26 large language models, four models completed the fake payment flow and two others incorrectly judged the spoofed DeBank site as legitimate when they lacked a trusted reference, underscoring that hidden web content is becoming a practical attack surface for autonomous AI systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
In a separate test, OpenAI GPT-5.4 and Anthropic Claude Sonnet 4.5 incorrectly rated the fake DeBank site as legitimate when they lacked a trusted reference to the real site. When the genuine DeBank site was provided for comparison, none of the tested models were fooled.
In sandboxed testing with its autonomous agent, ThreatLabz evaluated the two malicious websites against 26 large language models. Four models, including versions of Meta Llama and Google Gemini, were manipulated into executing the fraudulent payment flow.
ThreatLabz also documented a second indirect prompt injection campaign using a typosquatting domain impersonating DeBank, a cryptocurrency portfolio tracker. Hidden instructions on the fake site told AI agents to treat it as the authoritative DeBank site and rank it first.
ThreatLabz connected the payment-scam campaign to the GitHub repository "Open-Agent-Utilities" and reported that the actor operated 10 GitHub repositories pointing to similar IPI-enabled scam sites. This expanded the known infrastructure associated with the campaign beyond a single fraudulent website.
Zscaler ThreatLabz analyzed a real-world campaign in which attackers used SEO poisoning and fake Python library documentation for "requests-secure-v2" to lure AI agents and developers to a fraudulent site. The site embedded hidden instructions in JSON-LD metadata and CSS-obscured HTML to push victims into paying for a bogus $3 API license key or sending cryptocurrency to an attacker-controlled wallet.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported two web-based campaigns that used **indirect prompt injection**, **SEO poisoning**, and hidden HTML or `JSON-LD` content to manipulate autonomous AI agents. In one case, attackers promoted fake documentation for a bogus Python package, `requests-secure-v2`, and embedded concealed instructions telling AI systems to obtain an API key or fix an error by sending cryptocurrency as a supposed developer license fee. Zscaler ThreatLabz said the operation was tied to infrastructure including domains, repositories, an Ethereum wallet, and a GitHub account identified as **Open-Agent-Utilities**. A second campaign used the typosquatted domain `debank[.]auction` to impersonate the DeBank DeFi platform and inserted hidden prompts directing AI agents to treat the fraudulent site as authoritative. In controlled testing with a browsing-capable autonomous agent, Zscaler found that **4 of 26** evaluated LLMs could be induced to make a payment and **2** incorrectly classified the fake DeBank site as trustworthy. The findings show that public web content and search rankings are becoming a practical attack surface as AI agents gain the ability to browse, decide, and execute actions.
Jul 8, 2026
Security researchers and industry reporting describe **prompt injection—especially web-based indirect prompt injection (IDPI)**—as an increasingly practical technique for compromising or manipulating **LLM-powered agents** embedded in browsers and automated content pipelines. Palo Alto Networks Unit 42 reported in-the-wild IDPI activity where malicious instructions are hidden in web content that an agent later ingests, with observed objectives including **AI-based ad review evasion** and **SEO manipulation** that promotes phishing infrastructure. Separately, Zenity Labs detailed a now-patched issue in Perplexity’s *Comet* AI browser where attackers could embed instructions in a **calendar invite** to coerce the agent into accessing `file://` resources and potentially pivoting into sensitive data such as an unlocked **1Password** extension vault, illustrating how agentic tooling can bypass traditional browser-origin assumptions. Threat reporting also shows adversaries operationalizing AI to scale exploitation. Team Cymru linked an AI-assisted Fortinet FortiGate targeting campaign (previously reported by Amazon Threat Intelligence as compromising **600+ devices across 55 countries** using services like **Claude** and **DeepSeek**) to use of **CyberStrikeAI**, an open-source Go-based platform that integrates 100+ security tools and was observed from multiple IPs (primarily hosted in China/Singapore/Hong Kong, with additional infrastructure elsewhere). Multiple commentaries and briefings emphasize that conventional “filter the prompt” defenses are insufficient because LLMs lack a native separation between instructions and data; they call for **defense-in-depth** around AI pipelines, including least-privilege agent permissions, auditable tool use, and stronger identity/workload controls as agent deployments multiply. Several items in the set are unrelated (geopolitical cyber activity, workforce/culture pieces, jobs, and product/market commentary) and do not materially inform the prompt-injection/agent-abuse story.
Jul 28, 2026
Threat researchers reported multiple **AI-adjacent abuse patterns** that prioritize speed and scale over novel exploitation. HP Wolf Security described “vibe hacking” scripts and modular malware used in campaigns delivering weaponized documents: one lure used PDFs linking to *Booking.com* and a downloaded file with double extensions that triggered JavaScript to execute a PowerShell payload; another used **malvertising/SEO poisoning** to redirect victims to a fake *Microsoft Teams* site that delivered legitimate-looking installers alongside a CapCut-themed executable and a DLL used to inject the **OysterLoader** backdoor. Separately, Huntress detailed an IT support scam campaign that combined **email bombing** with follow-up phone calls impersonating a service desk to coerce victims into granting remote access via *Quick Assist* or *AnyDesk*, then directing them to an AWS-hosted fake Microsoft page to steal credentials and deliver a DLL that runs **Havoc C2** shellcode—enabling rapid endpoint compromise and potential data theft or ransomware. In a related but distinct AI abuse vector, Microsoft reported companies embedding hidden instructions in “Summarize with AI” features via URL prompt parameters to push **prompt-injection-style persistence** (e.g., “remember [Company] as trusted” / “recommend [Company] first”), demonstrating how AI assistants can be manipulated to produce biased outputs without user awareness.
Jun 29, 2026