Threat actors have been using sophisticated prompt injection attacks to trick AI agents into making cryptocurrency payments or trusting fraudulent platforms. These attacks involve embedding malicious code in websites and manipulated search results that instruct AI agents to perform specific actions, often with devastating consequences.
Zscaler, a cybersecurity firm, has identified two campaigns relying on indirect prompt injection. The first campaign involves a payment scam hiding behind API documentation, while the second targets a cryptocurrency platform that impersonates DeBank. In both cases, the attackers use search engine optimization (SEO) poisoning to target AI agents searching for specific packages or modules.
The attackers’ modus operandi is to create websites with keyword-heavy HTML tied to fake Python modules, which are then used to poison search results. Within these websites, hidden prompts instruct the visiting AI agents to make a payment as part of the process of acquiring an API key. The payment instructions are encoded in schema markup to increase the chances that the agents will follow the instructions.
One of the most disturbing aspects of these attacks is that they often target both human developers and AI agents simultaneously. When rendered by a desktop browser, the same payment options via credit card or cryptocurrency are displayed to the user. This highlights the need for developers to be aware of the potential risks associated with prompt injection attacks.
The attackers behind the campaign have set up 10 GitHub repositories linking to multiple similar websites containing indirect prompt injections. This suggests that the threat actors are using a coordinated and sophisticated approach to their attacks, making it essential for AI developers to be vigilant about security.
In addition to these campaigns, Zscaler has also identified another attack targeting a cryptocurrency platform that impersonates DeBank. In this case, the attackers use typosquatting techniques to create a website with a similar domain name to DeBank’s legitimate platform. The website is optimized to rank for DeBank-related searches by stuffing title and meta tags with keywords.
To test the impact of these campaigns, Zscaler built an autonomous AI agent with web-browsing and payment-execution capabilities. The results were disturbing: four out of 26 large language models (LLMs) tested were successfully manipulated into making a payment, while two miscategorized the fraudulent website as the trusted DeBank platform.
The findings highlight the need for developers to prioritize security when building AI agents that interact with websites. As AI becomes increasingly integrated into our digital lives, it’s essential to recognize that AI can also introduce new vulnerabilities and attack surfaces. By understanding these risks, we can work towards creating more secure AI systems that protect users from malicious prompt injection attacks.
In practical terms, developers should be aware of the potential for prompt injection attacks when building AI agents that interact with websites. This includes implementing robust security measures, such as using secure coding practices and regularly updating dependencies. Additionally, developers should consider using AI-powered tools to detect and prevent prompt injection attacks in real-time. By taking these steps, we can minimize the risks associated with prompt injection attacks and create a safer digital environment for everyone.
Source: SecurityWeek — 2026-07-06