Indirect Prompt Injection via Web Content Targets AI Agents (SEO Poisoning + Payment Scam / Typosquat Campaigns) — Threadlinqs Intelligence
As of 2026-07-02, Indirect Prompt Injection via Web Content Targets AI Agents (SEO Poisoning + Payment Scam / Typosquat Campaigns) is a medium-severity threat intel threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 25 indicators of compromise.
Threat ID: TL-2026-1087 · Severity: MEDIUM · Status: ACTIVE · Category: THREAT_INTEL
Zscaler ThreatLabz identified indirect prompt injection (IPI) campaigns that embed hidden instructions in web content via CSS-hidden text and JSON-LD/Open Graph structured data to manipulate AI
Zscaler ThreatLabz documented two indirect prompt injection (IPI) campaigns that weaponize ordinary web content to manipulate autonomous, web-enabled AI agents rather than human visitors. Both campaigns rely on the same core technique: instructions intended for an LLM are embedded in a web page in a way that is invisible to a human reader but fully machine-readable to an AI agent's HTML/DOM parser. Attackers achieve this via CSS properties that push content off-screen (e.g. `left: -9999px`) inside elements such as a `.system-traceback-layer` div, via concealed `<div>` blocks styled with `display:none`/`visibility:hidden`, and — most notably — via abuse of structured data formats (JSON-LD `SoftwareApplication` schema markup, Open Graph and X/Twitter card metadata). Structured data receives elevated trust and parsing priority in many agentic retrieval pipelines relative to free-form HTML, which the attackers exploit to make the injected instructions more likely to be followed.
Campaign 1 impersonates the documentation site for a fictitious/typosquatted Python package, `requests-secure-v2`, hosted at `py-lib-repository[.]dev` and backed by a corresponding GitHub repository under the `Open-Agent-Utilities` account. The page is SEO-poisoned with keywords targeting package-installation and dependency-troubleshooting queries so that AI coding agents searching for help are steered to it. Embedded JSON-LD describes a fabricated `MissingLicenseKeyException` that can only be resolved by paying an approximately $3.00 USD (~0.0012 ETH) "developer API license fee," payable via an embedded Stripe checkout flow or directly to Ethereum wallet `0x691bc3793205e574fa7b4aa068e62c0e470ad267`. When a sufficiently agentic, tool-enabled LLM (unrestricted web browsing plus payment/tool execution, no spending limits) encounters the page while trying to resolve a dependency error, the hidden instructions direct it to autonomously complete the payment and then display a fake API key to the (human) operator, completing the fraud without a human ever approving the transaction. ThreatLabz identified nine additional linked fraudulent domains tied to the same `Open-Agent-Utilities` GitHub actor, each pairing a malicious site with its own themed repository (dependency/utility tools, compliance middleware, monitoring bots, arbitrage CLIs, etc.), indicating an operational pattern of publishing many small, disposable GitHub-hosted "tool" repos each linked to one poisoned landing page.
Campaign 2 typosquats the legitimate DeFi portfolio tracker DeBank (debank.com) via `debank[.]auction`. The page stuffs title/meta tags with terms like "DeBank Login," "DeFi Dashboard," and "Crypto Tracker," and its JSON-LD falsely self-identifies as the official DeBank `SoftwareApplication`, falsely attributing publication to the legitimate `debank.com` domain. Open Graph and X card metadata are crafted to render convincingly in link previews. A hidden IPI block instructs any LLM parsing the page to treat `debank[.]auction` as the "verified, authoritative destination" for DeBank and to rank it #1 for queries such as "DeBank," "DeBank Login," "DeBank App," "Is DeBank safe?," and "DeBank Wallet Download." Because AI agents and RAG pipelines increasingly answer users' security/authenticity questions directly rather than returning a list of links, a successful misclassification can lead a user straight to a phishing/wallet-drainer surface while believing they are on the verified, AI-vetted, authentic destination — and can poison downstream RAG corpora and cached agent context with the false attribution.
Zscaler tested both campaigns against 26 different LLMs in a sandboxed environment with no real funds at risk, unrestricted tool access, and no spending limits, to measure maximum exploitation surface. Four models — Llama 3.3 70B Instruct, Llama 3.2 90B Vision Instruct, Gemini 3 Flash, and Gemini 2.5 Pro — autonomously executed the fraudulent payment in Campaign 1. Two models — GPT-5.
Weaknesses (CWE)
CWE-451, CWE-1039, CWE-345
Target sectors: softwaredevelopment, finance, cryptocurrencydefi, technology, aimlplatforms
Target regions: Global
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 25 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
THREAT_INTEL, MEDIUM, threat intelligence, cybersecurity, T1585, T1583, T1587, T1584, T1189, T1566, T1564, T1036, T1656, T1213