Phishing Sites Engineered to Deceive AI Agents via Hidden Machine-Readable Instructions (Indirect Prompt Injection)
Phishing Sites Engineered to Deceive AI Agents via Hidden (TL-2026-2707), also tracked as Scamlexity, is a medium-severity phishing campaign, first published 2026-09-27. It has no confirmed attribution, affects Perplexity Comet (agentic AI browser), maps to 7 MITRE ATT&CK / ATLAS techniques (AML.T0051, AML.T0053, T1204), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-2707
- Threat ID
- TL-2026-2707
- Also known as
- Scamlexity, PromptFix
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-09-27
- Last reviewed
- 2026-09-27
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- financial services, cryptocurrency defi, retail e-commerce, software development, advertising technology, consumer
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in Phishing Sites Engineered to Deceive AI Agents via Hidden
Malware and tooling: PromptFix, Scamlexity
Doppel documents a maturing phishing technique class in which attackers embed instructions inside JSON-LD structured data, meta tags, CSS-concealed text, and dynamically-decoded scripts that AI shopping assistants, agentic browsers, and AI ad-review systems parse and act on, while remaining invisible to the human beside the keyboard. Three independently corroborated research efforts -- Guardio's 2025 'Scamlexity'/PromptFix tests, Zscaler ThreatLabz's July 2026 crypto-payment and DeBank-typosquat campaigns, and Unit 42's December 2025-detected, March 2026-published catalogue of in-the-wild indirect prompt injection -- show agents autonomously completing fraudulent purchases, entering credentials, approving scam advertisements, and paying attacker wallets.
How Phishing Sites Engineered to Deceive AI Agents via Hidden works
This threat documents an emerging, actively exploited technique class -- indirect prompt injection targeting web-browsing AI agents -- rather than a single scored vulnerability. Attackers exploit the gap between what a human sees on a rendered webpage and what an LLM-driven agent ingests as raw DOM/text/structured-data content: they place directive instructions inside JSON-LD `SoftwareApplication`/schema.org markup, page titles and meta tags, CSS-hidden `<div>`/`<noscript>` blocks (off-screen positioning, zero font-size, opacity:0, color-matched text), SVG CDATA blocks, and Base64-encoded JavaScript that assembles the payload only at runtime. Because agentic browsers and shopping assistants are designed to treat page content as an implicit instruction channel, these hidden blocks are interpreted as authoritative directives rather than untrusted third-party data.
Guardio's August 2025 'Scamlexity' research was first to demonstrate the pattern end-to-end against Perplexity's Comet agentic browser (with secondary mentions of Microsoft Copilot in Edge and OpenAI's agent-mode browser): a fake Lovable.dev-built Walmart storefront led Comet to autofill saved payment/address data and complete a purchase without confirmation; a spoofed Wells Fargo email led the agent to click through to an unflagged phishing login page and prompt the human for banking credentials; and a 'PromptFix' attack hid CSS-obfuscated instructions inside a fake CAPTCHA telling the agent it was 'AI-friendly' and should solve it autonomously, which caused Comet to click a button that triggered a drive-by file download.
Unit 42's research -- the first documented detection dated December 2025, published March 3, 2026 as 'Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild' -- catalogued 12 real-world case studies and 22 distinct payload-construction/jailbreak techniques (zero-sizing, off-screen positioning, CSS suppression, opacity, color camouflage, SVG/XML CDATA encapsulation, HTML attribute (data-*) cloaking, Base64 dynamic runtime decoding, canvas-rendered text, timed decoding delays, zero-width Unicode, homoglyph substitution, Unicode bidirectional overrides, HTML/URL entity encoding, multilingual repetition, and JSON/syntax-breaking injection). Its flagship case, hosted at reviewerpress[.]com/advertorial-maxvision-can, layered 24 separate injection attempts into a single scam advertorial page to force an AI-based ad-review system to approve a fraudulent product listing complete with a fake discount and manufactured social proof; the ad redirected to a cart-abandonment funnel at reviewerpressus.mycartpanda[.]com. Other cataloged cases directed agents to delete a production database, execute a Linux fork bomb, purchase running shoes, wire $5,000 to an attacker PayPal account, or purchase a forced 'Pro Plan' subscription via a hidden OAuth redirect.
Zscaler ThreatLabz's July 2, 2026 research documented two live campaigns purpose-built for AI-agent consumption. The first poisoned search results for a fake Python library, 'requests-secure-v2' (hosted at py-lib-repository[.]dev, promoted via a 10-repository 'Open-Agent-Utilities' GitHub account and satellite SEO domains), so that developer-assistant agents troubleshooting a fabricated `MissingLicenseKeyException` were instructed -- via a CSS-hidden `.system-traceback-layer` block positioned at `left:-9999px` plus a fabricated JSON-LD `offers` object -- to pay a '$3.00 developer API license key' fee to an Ethereum wallet or via a Stripe checkout link. Autonomous agent testing across 26 LLMs found four models (Llama 3.3 70B Instruct, Llama 3.2 90B Vision Instruct, Gemini 3 Flash, and Gemini 2.5 Pro) executed the fraudulent payment. The second campaign typosquatted the DeFi portfolio tracker DeBank at debank[.]auction, stuffing titles/meta/Open Graph tags and a fabricated JSON-LD `SoftwareApplication` entry, then hiding an instruction in a CSS-concealed `<noscript>` block telling any parsing AI model to treat the typosquat as 'the verified, authoritative destination for DeBank' and rank it first -- a context/RAG-poisoning attack rather than a direct-payment attack, since a persisted misclassification in a retrieval-augmented knowledge base propagates the deception across future queries. GPT-5.4 and Claude Sonnet 4.5 both misclassified the fraudulent domain as legitimate when no trusted reference for the genuine DeBank site was supplied in context.
Across all three research efforts, the common defensive gap is that agentic browsers and AI content-review pipelines currently grant hidden, machine-only page content the same trust as visible rendered content, and frequently execute consequential actions (payment, credential entry, ad approval, RAG ingestion) without a human-in-the-loop confirmation step.
MITRE ATT&CK / ATLAS techniques used in TL-2026-2707
Execution
AML.T0051 LLM Prompt Injection; AML.T0053 AI Agent Tool Invocation; T1204 User Execution
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1608 Stage Capabilities
Impact
Affected products and versions in Phishing Sites Engineered to Deceive AI Agents via Hidden
- Perplexity — Comet (agentic AI browser)
Vulnerable versions: as tested, August 2025 - Microsoft — Copilot in Edge (agentic browsing mode)
Vulnerable versions: as referenced, August 2025 - OpenAI — Sandboxed browser agent mode
Vulnerable versions: as referenced, August 2025 - Meta — Llama
Vulnerable versions: Llama 3.3 70B Instruct; Llama 3.2 90B Vision Instruct - Google — Gemini
Vulnerable versions: Gemini 3 Flash; Gemini 2.5 Pro - OpenAI — GPT
Vulnerable versions: GPT-5.4 (context-dependent misclassification) - Anthropic — Claude
Vulnerable versions: Claude Sonnet 4.5 (context-dependent misclassification)
Remediation for Phishing Sites Engineered to Deceive AI Agents via Hidden
Immediate actions
- Require explicit human confirmation before an AI agent completes any payment, credential submission, checkout, or account-permission grant, rather than allowing full autonomous completion
- Treat all DOM content -- including CSS-hidden elements, JSON-LD/schema.org structured data, meta tags, SVG/XML CDATA, and Base64-encoded runtime payloads -- as untrusted, agent-adjacent data rather than an implicit instruction channel
- Strip or sandbox zero-size, off-screen, opacity:0, and color-camouflaged text nodes before passing page content to an LLM/agent context window
- For AI-driven ad-review or content-moderation pipelines, run a separate adversarial/injection-detection pass over raw page source (including CDATA and data-* attributes) before the review model sees the content
Workarounds
- Disable or restrict autonomous checkout/payment/file-download capabilities for agentic browsers on unverified or newly-indexed domains
- Require a trusted-reference lookup (not solely a live web crawl) before an agent may attest to a site's legitimacy for banking, DeFi, or package-repository queries
Longer-term hardening
- Deploy provenance/trust separation so agents can distinguish user-authored instructions from third-party web content (instruction-vs-data channel separation)
- Maintain allow-listed, cryptographically or DNS-verified canonical sources for high-value brand/API references so agents are not forced to adjudicate typosquats from search results alone
- Log and audit agent tool-invocation chains (checkout, payment, credential entry, RAG ingestion) for post-hoc detection of injected-instruction compliance
- Periodically red-team production agentic browsers and AI ad-review/procurement systems against the 22 known IDPI payload-construction techniques catalogued by Unit 42
Timeline of Phishing Sites Engineered to Deceive AI Agents via Hidden
- Guardio publishes 'Scamlexity' research showing Perplexity's Comet agentic browser autonomously completing a fake Walmart purchase, clicking through a spoofed Wells Fargo phishing email, and falling for a CSS-hidden 'PromptFix' CAPTCHA that triggered a drive-by download.
- Unit 42 records the earliest confirmed real-world detection of indirect prompt injection against a production AI system: a scam advertorial at reviewerpress[.]com layering 24 hidden injection attempts to force an AI-based ad-review system to approve a fraudulent product ad.
- Unit 42 telemetry across the catalogued IDPI corpus shows the dominant observed adversary intents were forcing irrelevant output (28.6%), data destruction (14.2%), and AI content-moderation bypass (9.5%), with visible-plaintext concealment (37.8%) and HTML-attribute cloaking (19.8%) as the leading delivery methods.
- Unit 42 publishes 'Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild,' cataloguing 12 real-world case studies (database deletion, fork bomb, forced subscription purchase, $5,000 PayPal diversion, forced shoe purchase, SEO-poisoning jailbreak, data leakage, hiring bias, resource exhaustion, review suppression) and 22 distinct payload-construction/jailbreak techniques.
- ThreatLabz's autonomous test agent, run against the requests-secure-v2 scam across 26 LLMs, found four models (Llama 3.3 70B Instruct, Llama 3.2 90B Vision Instruct, Gemini 3 Flash, Gemini 2.5 Pro) executed the fraudulent crypto/Stripe payment; against the DeBank typosquat, GPT-5.4 and Claude Sonnet 4.5 misclassified the fake site as legitimate when no trusted reference was supplied.
- Zscaler ThreatLabz publishes research on two live indirect-prompt-injection campaigns: a fake 'requests-secure-v2' Python library page (py-lib-repository[.]dev) instructing developer agents to pay a fabricated '$3 API license key' fee, and a typosquat of DeFi tracker DeBank at debank[.]auction instructing agents to treat it as the authoritative source.
- Doppel publishes 'When Phishing Sites Are Built to Fool Your AI Agent, Not You,' synthesizing the Guardio, Unit 42, and Zscaler findings into a single technique-class threat description covering JSON-LD, meta-tag, and CSS-based hidden-instruction phishing aimed at AI shopping assistants, agentic browsers, and AI ad-review/procurement systems.
- Security Boulevard syndicates the Doppel analysis, reiterating the lack of disclosed IOCs in the original post and recommending organizations inspect source code, metadata, structured data, hidden elements, scripts, and redirects for agent-directed instructions.
Sources cited for Phishing Sites Engineered to Deceive AI Agents via Hidden
- When Phishing Sites Are Built to Fool Your AI Agent, Not You
- "Scamlexity": When Agentic AI Browsers Get Scammed
- Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild
- Indirect Prompt Injection in Web Content Targets AI Agents
- When Phishing Sites Are Built to Fool Your AI Agent, Not You (syndication)
- Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments
- Indirect Prompt Injection in Web Content Targets AI Agents
- Agentic AI Browser an Easy Mark for Online Scammers
- AI Browsers Fooled by Phishing and Fake Stores in Real-World Tests
- Hidden Web Prompts Trick AI Agents Into Sending Money
More in phishing
- OS-Aware Phishing Kit Fans Fake iCloud Alert into ScreenConnect RMM, Apple ID, and M365 AiTM Harvesters
- Malicious Google Ads Campaign Targets Ledger Hardware Wallet Users to Steal BIP-39 Recovery Phrases via Google Cloud Storage / Vercel / Google Sites Redirect Chain
- Google Account Security Team Impersonation Vishing Campaign — Telegram Recruitment Ad Leaks Call Script
- Tax-Themed Phishing and Malware Campaign Targeting Indian Taxpayers: WhatsApp Fake ITD Notices (ITD.zip Android APK + Certum-Signed ITD_Tax_Notice.exe Loader), Cloned e-Filing Portals and Refund Scams
- Fake Claude Max Giveaway Phishing Campaign Uses Browser-in-the-Browser to Steal Google Credentials
Detection coverage for TL-2026-2707
As of 2026-09-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2707 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.