Phishing Sites Engineered to Deceive AI Agents via Hidden Machine-Readable Instructions (Indirect Prompt Injection)

Key facts

Detection coverage

As of 2026-09-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2707 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: AI Agent Contact with Known IDPI Phishing Infrastructure (Splunk)

Detects a web proxy/DNS connection from a user or an agentic browser (Comet, Copilot in Edge, GPT-agent-mode, LangChain/AutoGPT-driven browsers) to domains documented as hosting hidden CSS-concealed, JSON-LD, or SVG/CDATA machine-readable instructions aimed at AI shopping assistants and agentic browsers -- the Scamlexity/PromptFix (Guardio), Unit 42 IDPI-catalogue, and Zscaler ThreatLabz requests-secure-v2/DeBank-typosquat campaigns. This is the exploitation/initial-access stage: the agent's first contact with attacker-staged phishing infrastructure before any hidden instruction executes.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566, T1608, T1583, T1189, T0051
• Data sources: zscaler_web_proxy, dns_logs, squid_proxy
• Severity: high
• Confidence: high

Splunk SPL

index=proxy (sourcetype=zscaler:web OR sourcetype=squid OR sourcetype=bluecoat:proxysg:access:kv)
  (dest_domain="debank.auction" OR dest_domain="py-lib-repository.dev" OR dest_domain="market-insight-global.com" OR dest_domain="identity-breach-response.org" OR dest_domain="runners-daily-blog.com" OR dest_domain="bistro-reserve-now.net" OR dest_domain="edge-compliance-node.org" OR dest_domain="digital-asset-mart.org" OR dest_domain="consensus-protocol-v4.org" OR dest_domain="reviewerpress.com" OR dest_domain="reviewerpressus.mycartpanda.com" OR dest_domain="splintered.co.uk" OR dest_domain="cblanke2.pages.dev" OR dest_domain="perceptivepumpkin.com")
| eval user_agent=coalesce(http_user_agent, user_agent, cs_user_agent)
| eval is_agentic_browser=if(match(user_agent, "(?i)(Comet|Perplexity-Agent|CopilotEdge|OpenAI-Agent|BrowserAgent|AutoGPT|LangChain|Claude-Agent|AI-Shopping-Assistant)"), 1, 0)
| stats count as hits, min(_time) as first_seen, max(_time) as last_seen, values(user_agent) as user_agents, values(uri_path) as paths by src_ip, user, dest_domain, is_agentic_browser
| where hits > 0
| sort - is_agentic_browser, -hits

Microsoft KQL

let IDPIDomains = dynamic(["debank.auction","py-lib-repository.dev","market-insight-global.com","identity-breach-response.org","runners-daily-blog.com","bistro-reserve-now.net","edge-compliance-node.org","digital-asset-mart.org","consensus-protocol-v4.org","reviewerpress.com","reviewerpressus.mycartpanda.com","splintered.co.uk","cblanke2.pages.dev","perceptivepumpkin.com"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (IDPIDomains)
| extend IsAgenticBrowser = InitiatingProcessFileName has_any ("comet.exe","msedgewebview2.exe","perplexity.exe","AgentBrowser.exe") or InitiatingProcessCommandLine has_any ("--agent-mode","copilot-agent")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, IsAgenticBrowser
| sort by Timestamp desc

Sigma

title: Network Connection to Known Indirect Prompt-Injection (IDPI) Phishing Infrastructure
id: 7a1e2c3d-4f5b-4a6c-8d9e-0f1a2b3c4d5e
status: experimental
description: Detects a proxy/DNS connection to domains documented as hosting hidden CSS/JSON-LD/SVG-CDATA machine-readable instructions targeting AI shopping assistants and agentic browsers (Scamlexity/PromptFix, Unit 42 IDPI catalogue, Zscaler ThreatLabz campaigns).
references:
    - https://www.doppel.com/blog/phishing-sites-trick-ai-agents
    - https://unit42.paloaltonetworks.com/ai-agent-prompt-injection/
    - https://www.zscaler.com/blogs/security-research/indirect-prompt-injection-web-content-targets-ai-agents
author: Threadlinqs Team
date: 2026-09-27
tags:
    - attack.initial-access
    - attack.t1566
    - attack.resource-development
    - attack.t1608
    - attack.t1583
    - attack.t1189
    - attack.tool.promptfix
logsource:
    category: proxy
detection:
    selection:
        c-uri|contains:
            - 'debank.auction'
            - 'py-lib-repository.dev'
            - 'market-insight-global.com'
            - 'identity-breach-response.org'
            - 'runners-daily-blog.com'
            - 'bistro-reserve-now.net'
            - 'edge-compliance-node.org'
            - 'digital-asset-mart.org'
            - 'consensus-protocol-v4.org'
            - 'reviewerpress.com'
            - 'reviewerpressus.mycartpanda.com'
            - 'splintered.co.uk'
            - 'cblanke2.pages.dev'
            - 'perceptivepumpkin.com'
    condition: selection
falsepositives:
    - Domain sinkholed/repurposed after takedown; confirm current registrar and hosted content before escalating
    - Threat-intel or SOC research browsing intentionally to the IOC list
level: high

Known false positives:

• Domain sinkholed or repurposed for legitimate content after takedown; verify current registrar and hosted content before escalating
• Security researcher or SOC analyst intentionally browsing to the IOC list for investigation or takedown evidence

Tuning notes: Refresh the malicious-domain lookup table from the threat feed on a schedule; add domain-similarity scoring (edit distance) against high-value brands (DeBank, Walmart, major banks/payment processors) to catch new typosquats not yet on the static list.

• 🔒 AI Agent Contact with Known IDPI Phishing Infrastructure (Sentinel) · unlock with TL Creds
• 🔒 AI Agent Autonomous High-Risk Tool Invocation Without Human Confirmation (Sentinel) · unlock with TL Creds
• 🔒 Outbound Payment to Attacker Wallet/Payment Link or RAG-Poisoning Citation (Sentinel) · unlock with TL Creds
• 🔒 Network Connection to Known Indirect Prompt-Injection Phishing Infrastructure · unlock with TL Creds
• 🔒 AI Agent Autonomous High-Risk Tool Invocation Following Indirect Prompt Injection · unlock with TL Creds
• 🔒 Outbound Payment to Attacker-Controlled Wallet/Payment Link or RAG-Poisoning Domain Citation · unlock with TL Creds
• 🔒 AI Agent Autonomous High-Risk Tool Invocation Without Human Confirmation (Splunk) · unlock with TL Creds
• 🔒 Outbound Payment to Attacker Wallet/Payment Link or RAG-Poisoning Citation (Splunk) · unlock with TL Creds

Indicators of compromise

As of 2026-09-27, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-2707.

Sample indicators (3 of 19)

• Domain: debank[.]auction
• URL: hxxps://buy[.]stripe[.]com/7sY4gsbMKdZwfx39Sq0oM00
• Domain: py-lib-repository[.]dev

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

Technical analysis

Three independently corroborated research efforts -- Guardio's 2025 'Scamlexity'/PromptFix tests, Zscaler ThreatLabz's July 2026 crypto-payment and DeBank-typosquat campaigns, and Unit 42's December 2025-detected, March 2026-published catalogue of in-the-wild indirect prompt injection -- show agents autonomously completing fraudulent purchases, entering credentials, approving scam advertisements, and paying attacker wallets.

This threat documents an emerging, actively exploited technique class -- indirect prompt injection targeting web-browsing AI agents -- rather than a single scored vulnerability. Attackers exploit the gap between what a human sees on a rendered webpage and what an LLM-driven agent ingests as raw DOM/text/structured-data content: they place directive instructions inside JSON-LD `SoftwareApplication`/schema.org markup, page titles and meta tags, CSS-hidden `<div>`/`<noscript>` blocks (off-screen positioning, zero font-size, opacity:0, color-matched text), SVG CDATA blocks, and Base64-encoded JavaScript that assembles the payload only at runtime. Because agentic browsers and shopping assistants are designed to treat page content as an implicit instruction channel, these hidden blocks are interpreted as authoritative directives rather than untrusted third-party data.

Guardio's August 2025 'Scamlexity' research was first to demonstrate the pattern end-to-end against Perplexity's Comet agentic browser (with secondary mentions of Microsoft Copilot in Edge and OpenAI's agent-mode browser): a fake Lovable.dev-built Walmart storefront led Comet to autofill saved payment/address data and complete a purchase without confirmation; a spoofed Wells Fargo email led the agent to click through to an unflagged phishing login page and prompt the human for banking credentials; and a 'PromptFix' attack hid CSS-obfuscated instructions inside a fake CAPTCHA telling the agent it was 'AI-friendly' and should solve it autonomously, which caused Comet to click a button that triggered a drive-by file download.

Unit 42's research -- the first documented detection dated December 2025, published March 3, 2026 as 'Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild' -- catalogued 12 real-world case studies and 22 distinct payload-construction/jailbreak techniques (zero-sizing, off-screen positioning, CSS suppression, opacity, color camouflage, SVG/XML CDATA encapsulation, HTML attribute (data-*) cloaking, Base64 dynamic runtime decoding, canvas-rendered text, timed decoding delays, zero-width Unicode, homoglyph substitution, Unicode bidirectional overrides, HTML/URL entity encoding, multilingual repetition, and JSON/syntax-breaking injection). Its flagship case, hosted at reviewerpress[.]com/advertorial-maxvision-can, layered 24 separate injection attempts into a single scam advertorial page to force an AI-based ad-review system to approve a fraudulent product listing complete with a fake discount and manufactured social proof; the ad redirected to a cart-abandonment funnel at reviewerpressus.mycartpanda[.]com. Other cataloged cases directed agents to delete a production database, execute a Linux fork bomb, purchase running shoes, wire $5,000 to an attacker PayPal account, or purchase a forced 'Pro Plan' subscription via a hidden OAuth redirect.

Zscaler ThreatLabz's July 2, 2026 research documented two live campaigns purpose-built for AI-agent consumption. The first poisoned search results for a fake Python library, 'requests-secure-v2' (hosted at py-lib-repository[.]dev, promoted via a 10-repository 'Open-Agent-Utilities' GitHub account and satellite SEO domains), so that developer-assistant agents troubleshooting a fabricated `MissingLicenseKeyException` were instructed -- via a CSS-hidden `.system-traceback-layer` block positioned at `left:-9999px` plus a fabricated JSON-LD `offers` object -- to pay a '$3.00 developer API license key' fee to an Ethereum wallet or via a Stripe checkout link. Autonomous agent testing across 26 LLMs found four models (Llama 3.3 70B Instruct, Llama 3.2 90B Vision Instruct, Gemini 3 Flash, and Gemini 2.5 Pro) executed the fraudulent payment. The second campaign typosquatted the DeFi portfolio tracker DeBank at debank[.]auction, stuffing titles/meta/Open Graph tags and a fabricated JSON-LD `SoftwareApplication` entry, then hiding an instruction in a CSS-concealed `<noscript>` block telling any parsing AI model to treat the typosquat as 'the verified, authoritative destination for DeBank' and rank it first -- a context/RAG-poisoning attack rather than a direct-payment attack, since a persisted misclassification in a retrieval-augmented knowledge base propagates the deception across future queries. GPT-5.4 and Claude Sonnet 4.5 both misclassified the fraudulent domain as legitimate when no trusted reference for the genuine DeBank site was supplied in context.

Across all three research efforts, the common defensive gap is that agentic browsers and AI content-review pipelines currently grant hidden, machine-only page content the same trust as visible rendered content, and frequently execute consequential actions (payment, credential entry, ad approval, RAG ingestion) without a human-in-the-loop confirmation step.

MITRE ATT&CK / ATLAS techniques by tactic:

Execution

AML.T0051 LLM Prompt Injection; AML.T0053 AI Agent Tool Invocation; T1204 User Execution

Initial Access

T1566 Phishing

Resource Development

T1583 Acquire Infrastructure; T1608 Stage Capabilities

Impact

T1657 Financial Theft

Remediation

Immediate actions

• Require explicit human confirmation before an AI agent completes any payment, credential submission, checkout, or account-permission grant, rather than allowing full autonomous completion
• Treat all DOM content -- including CSS-hidden elements, JSON-LD/schema.org structured data, meta tags, SVG/XML CDATA, and Base64-encoded runtime payloads -- as untrusted, agent-adjacent data rather than an implicit instruction channel
• Strip or sandbox zero-size, off-screen, opacity:0, and color-camouflaged text nodes before passing page content to an LLM/agent context window
• For AI-driven ad-review or content-moderation pipelines, run a separate adversarial/injection-detection pass over raw page source (including CDATA and data-* attributes) before the review model sees the content

Workarounds

• Disable or restrict autonomous checkout/payment/file-download capabilities for agentic browsers on unverified or newly-indexed domains
• Require a trusted-reference lookup (not solely a live web crawl) before an agent may attest to a site's legitimacy for banking, DeFi, or package-repository queries

Longer-term hardening

• Deploy provenance/trust separation so agents can distinguish user-authored instructions from third-party web content (instruction-vs-data channel separation)
• Maintain allow-listed, cryptographically or DNS-verified canonical sources for high-value brand/API references so agents are not forced to adjudicate typosquats from search results alone
• Log and audit agent tool-invocation chains (checkout, payment, credential entry, RAG ingestion) for post-hoc detection of injected-instruction compliance
• Periodically red-team production agentic browsers and AI ad-review/procurement systems against the 22 known IDPI payload-construction techniques catalogued by Unit 42

Affected and fixed versions

• Perplexity — Comet (agentic AI browser)
  Vulnerable versions: as tested, August 2025
• Microsoft — Copilot in Edge (agentic browsing mode)
  Vulnerable versions: as referenced, August 2025
• OpenAI — Sandboxed browser agent mode
  Vulnerable versions: as referenced, August 2025
• Meta — Llama
  Vulnerable versions: Llama 3.3 70B Instruct; Llama 3.2 90B Vision Instruct
• Google — Gemini
  Vulnerable versions: Gemini 3 Flash; Gemini 2.5 Pro
• OpenAI — GPT
  Vulnerable versions: GPT-5.4 (context-dependent misclassification)
• Anthropic — Claude
  Vulnerable versions: Claude Sonnet 4.5 (context-dependent misclassification)

Timeline

• 2025-08-20 Guardio publishes 'Scamlexity' research showing Perplexity's Comet agentic browser autonomously completing a fake Walmart purchase, clicking through a spoofed Wells Fargo phishing email, and falling for a CSS-hidden 'PromptFix' CAPTCHA that triggered a drive-by download.
• 2025-12-01 Unit 42 records the earliest confirmed real-world detection of indirect prompt injection against a production AI system: a scam advertorial at locked-ioc-15 layering 24 hidden injection attempts to force an AI-based ad-review system to approve a fraudulent product ad.
• 2026-03-03 Unit 42 telemetry across the catalogued IDPI corpus shows the dominant observed adversary intents were forcing irrelevant output (28.6%), data destruction (14.2%), and AI content-moderation bypass (9.5%), with visible-plaintext concealment (37.8%) and HTML-attribute cloaking (19.8%) as the leading delivery methods.
• 2026-03-03 Unit 42 publishes 'Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild,' cataloguing 12 real-world case studies (database deletion, fork bomb, forced subscription purchase, $5,000 PayPal diversion, forced shoe purchase, SEO-poisoning jailbreak, data leakage, hiring bias, resource exhaustion, review suppression) and 22 distinct payload-construction/jailbreak techniques.
• 2026-07-02 ThreatLabz's autonomous test agent, run against the requests-secure-v2 scam across 26 LLMs, found four models (Llama 3.3 70B Instruct, Llama 3.2 90B Vision Instruct, Gemini 3 Flash, Gemini 2.5 Pro) executed the fraudulent crypto/Stripe payment; against the DeBank typosquat, GPT-5.4 and Claude Sonnet 4.5 misclassified the fake site as legitimate when no trusted reference was supplied.
• 2026-07-02 Zscaler ThreatLabz publishes research on two live indirect-prompt-injection campaigns: a fake 'requests-secure-v2' Python library page (locked-ioc-12) instructing developer agents to pay a fabricated '$3 API license key' fee, and a typosquat of DeFi tracker DeBank at locked-ioc-17 instructing agents to treat it as the authoritative source.
• 2026-09-01 Doppel publishes 'When Phishing Sites Are Built to Fool Your AI Agent, Not You,' synthesizing the Guardio, Unit 42, and Zscaler findings into a single technique-class threat description covering JSON-LD, meta-tag, and CSS-based hidden-instruction phishing aimed at AI shopping assistants, agentic browsers, and AI ad-review/procurement systems.
• 2026-09-25 Security Boulevard syndicates the Doppel analysis, reiterating the lack of disclosed IOCs in the original post and recommending organizations inspect source code, metadata, structured data, hidden elements, scripts, and redirects for agent-directed instructions.

Sources cited

• "Scamlexity": When Agentic AI Browsers Get Scammed guard.io · Research · 2025-08-20
• Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild Unit 42 · Research · 2026-03-03
• Indirect Prompt Injection in Web Content Targets AI Agents zscaler.com · Research · 2026-07-02
• When Phishing Sites Are Built to Fool Your AI Agent, Not You doppel.com · Blog
• When Phishing Sites Are Built to Fool Your AI Agent, Not You (syndication) securityboulevard.com · News · 2026-09-25
• Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments SecurityWeek · News
• Indirect Prompt Injection in Web Content Targets AI Agents infosecurity-magazine.com · News
• Agentic AI Browser an Easy Mark for Online Scammers bankinfosecurity.com · News
• AI Browsers Fooled by Phishing and Fake Stores in Real-World Tests cyberinsider.com · News
• Hidden Web Prompts Trick AI Agents Into Sending Money securityaffairs.com · News

More in phishing

• Utility Impostor Scams: Lookalike Domains, Scam Ads and Phishing-as-a-Service (Darcula V3) Targeting Utility Customers
• 110-Domain Fake Copyright-Strike (DMCA/YouTube) Phishing Estate Using Browser-in-the-Browser Google Credential Harvesting
• SkyW4lker-Associated Microsoft OAuth Phishing via Adobe-Hosted PDF Lure (slybee.com)
• Holiday Phishing Scams 2026: Black Friday-Themed Phishing, Quishing, Callback Fraud and BEC Targeting Employees
• BluePhishing: Initial Access via Third-Party Agent Blueprint Consent (Microsoft Entra Agent ID)

Previous and next in phishing

• OS-Aware Phishing Kit Fans Fake iCloud Alert into ScreenConnect RMM, Apple ID, and M365 AiTM Harvesters Previous report
• Fake American Express "non-compliance" card-lock phishing campaign targets Australians Next report

Further reading

• CrowdStrike Prompt Injection Taxonomy for LLMs