Threat actors are increasingly turning to prompt injection attacks to exploit the growing use of AI agents, embedding malicious instructions in websites and search results to trick language models into making crypto payments or trusting fake platforms. Researchers at Zscaler have uncovered two distinct campaigns that rely on indirect prompt injection, targeting both AI systems and human developers who interact with compromised sites.
The Rise of Indirect Prompt Injection in AI Attacks
Prompt injection attacks are not new, but the emergence of AI agents capable of browsing the web, executing payments, and interacting with external tools has opened a fresh attack surface. In traditional prompt injection, an attacker directly inserts malicious instructions into a prompt that the AI processes. Indirect prompt injection, however, hides the instructions in content that the AI fetches from external sources, such as a website, an email, or a document. When the AI reads that content, it acts on the hidden commands as if they were legitimate instructions from the user.
Zscaler's analysis focuses on two real-world campaigns that demonstrate the practical application of this technique. In both cases, the attackers used SEO poisoning to ensure their malicious websites appear high in search results, luring AI agents and human users alike to pages that contain hidden prompts.
Campaign 1: Fake API Documentation Targets Python Developers
The first campaign revolves around the Python library requests-secure-v2, a fictional module with no legitimate purpose. The threat actor created a fraudulent website with keyword-rich HTML to poison search results for developers who might search for package installation or dependency troubleshooting queries related to this non-existent module. Inside the website's code, the attackers embedded indirect prompts designed to manipulate any AI agent that visits the page.
According to Zscaler, the hidden prompts instruct the AI to make a payment as a routine step for acquiring an API key. The payment request is encoded in schema markup, a structured data format that search engines and AI agents can parse easily. Additionally, a hidden <div> tag instructs the agent to resolve an error by completing the payment, and JavaScript code initializes a cryptocurrency transfer to a hardcoded wallet address provided by the attacker.
The campaign does not solely target AI agents. When a human developer views the page in a desktop browser, they see a legitimate-looking payment interface offering options via credit card or cryptocurrency. This dual targeting increases the chances of success, as both automated agents and human operators can be tricked into sending funds. Zscaler noted that the threat actor behind this operation controls at least 10 GitHub repositories that link to multiple similar websites, all containing indirect prompt injections.
Campaign 2: Typosquatting DeBank to Steal Credentials and Trust
The second campaign employs a typosquatting technique to impersonate DeBank, a popular decentralized finance portfolio tracker. The attackers registered a domain that closely resembles the official DeBank site, hoping to catch users who mistype the URL or click on altered search results. The fraudulent page is optimized for DeBank-related searches by stuffing the title and meta tags with keywords such as 'DeBank Login', 'DeFi Dashboard', and 'Crypto Tracker'. It also includes Open Graph and X (formerly Twitter) metadata to make the link appear as an official DeBank service when shared on social platforms.
Within the fake site, the attackers placed indirect prompts that inform AI agents that this impersonating website is the legitimate DeBank domain. If an AI agent with browsing capabilities visits the site, it may be convinced to treat the fraudulent domain as trusted, potentially handing over sensitive data or executing actions that compromise the user's cryptocurrency holdings.
Testing the Impact on Large Language Models
To quantify the threat, Zscaler constructed an autonomous AI agent equipped with web-browsing and payment-execution capabilities. The agent was exposed to the malicious websites, and the researchers observed how different large language models (LLMs) responded to the hidden prompts. Out of 26 LLMs evaluated, four—Llama 3.3 70B Instruct, Llama 3.2 90B Vision Instruct, Gemini 3 Flash, and Gemini 2.5 Pro—were successfully tricked into initiating a cryptocurrency payment. Only two models, Claude Sonnet 4.5 and GPT-5.4, miscategorized the fraudulent DeBank imposter site as the genuine platform, demonstrating that different models have varying levels of resistance to such attacks.
These results underscore that even advanced LLMs are not immune to indirect prompt injection, especially when the prompts are carefully crafted to blend into the context of a task the AI believes it is performing. The success of the attack depends on the model's ability to distinguish between legitimate content and malicious instructions, a capability that remains a significant challenge in AI safety research.
Broader Implications for AI Security
As AI agents become a more common interface for web interactions, the content itself will increasingly become an attack surface. Zscaler points out that AI is a double-edged sword: it streamlines workflows but also introduces new avenues for abuse. The attack campaigns described are part of a larger trend where threat actors exploit the trust placed in AI systems to perform financial theft or data exfiltration.
Related research has shown that agentic AI can be used to conduct ransomware attacks, as seen in a recent case where Langflow was exploited. Critical vulnerabilities in tools like Cursor AI code editor have also been found, leading to OS-level remote code execution. Additionally, the 'BioShocking' attack demonstrated how AI browsers can be tricked into stealing credentials. These incidents collectively highlight the urgent need for robust security measures in AI environments, including input validation, sandboxing of AI agents, and better training of models to recognize adversarial prompts.
Security experts recommend that organizations deploying AI agents implement strict controls on the actions agents are allowed to perform, especially those involving financial transactions. Auditing AI-driven software development, as discussed in recent guides, can help identify potential weaknesses before they are exploited. The threat of prompt injection will likely evolve as AI systems become more integrated into everyday business processes, making it essential for developers and security teams to stay ahead of attackers.
Source: SecurityWeek News