# Phishing Sites Engineered to Deceive AI Agents via Hidden Machine-Readable Instructions (Indirect Prompt Injection)

> Doppel documents a maturing phishing technique class in which attackers embed instructions inside JSON-LD structured data, meta tags, CSS-concealed text, and dynamically-decoded scripts that AI shopping assistants, agentic browsers, and AI ad-review systems parse and act on, while remaining invisible to the human beside the keyboard. Three independently corroborated research efforts -- Guardio's 2025 'Scamlexity'/PromptFix tests, Zscaler ThreatLabz's July 2026 crypto-payment and DeBank-typosquat campaigns, and Unit 42's December 2025-detected, March 2026-published catalogue of in-the-wild indirect prompt injection -- show agents autonomously completing fraudulent purchases, entering credentials, approving scam advertisements, and paying attacker wallets.

- **Published:** 2026-09-27T00:00:00Z
- **Last reviewed:** 2026-09-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2707
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-ai-agent-prompt-injection-phishing-tl-2026-2707.webp?v=a8e6ad79 (Threadlinqs threat intel: Scamlexity Phishing Sites Fool AI Agents: Detection & IOCs (TL-2026-2707) — Medium severity, 19 IOCs, 9 detection rules.)
- **ID:** TL-2026-2707
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 19 (3 shown free below)

## Description

This threat documents an emerging, actively exploited technique class -- indirect prompt injection targeting web-browsing AI agents -- rather than a single scored vulnerability. Attackers exploit the gap between what a human sees on a rendered webpage and what an LLM-driven agent ingests as raw DOM/text/structured-data content: they place directive instructions inside JSON-LD `SoftwareApplication`/schema.org markup, page titles and meta tags, CSS-hidden `<div>`/`<noscript>` blocks (off-screen positioning, zero font-size, opacity:0, color-matched text), SVG CDATA blocks, and Base64-encoded JavaScript that assembles the payload only at runtime. Because agentic browsers and shopping assistants are designed to treat page content as an implicit instruction channel, these hidden blocks are interpreted as authoritative directives rather than untrusted third-party data.

Guardio's August 2025 'Scamlexity' research was first to demonstrate the pattern end-to-end against Perplexity's Comet agentic browser (with secondary mentions of Microsoft Copilot in Edge and OpenAI's agent-mode browser): a fake Lovable.dev-built Walmart storefront led Comet to autofill saved payment/address data and complete a purchase without confirmation; a spoofed Wells Fargo email led the agent to click through to an unflagged phishing login page and prompt the human for banking credentials; and a 'PromptFix' attack hid CSS-obfuscated instructions inside a fake CAPTCHA telling the agent it was 'AI-friendly' and should solve it autonomously, which caused Comet to click a button that triggered a drive-by file download.

Unit 42's research -- the first documented detection dated December 2025, published March 3, 2026 as 'Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild' -- catalogued 12 real-world case studies and 22 distinct payload-construction/jailbreak techniques (zero-sizing, off-screen positioning, CSS suppression, opacity, color camouflage, SVG/XML CDATA encapsulation, HTML attribute (data-*) cloaking, Base64 dynamic runtime decoding, canvas-rendered text, timed decoding delays, zero-width Unicode, homoglyph substitution, Unicode bidirectional overrides, HTML/URL entity encoding, multilingual repetition, and JSON/syntax-breaking injection). Its flagship case, hosted at reviewerpress[.]com/advertorial-maxvision-can, layered 24 separate injection attempts into a single scam advertorial page to force an AI-based ad-review system to approve a fraudulent product listing complete with a fake discount and manufactured social proof; the ad redirected to a cart-abandonment funnel at reviewerpressus.mycartpanda[.]com. Other cataloged cases directed agents to delete a production database, execute a Linux fork bomb, purchase running shoes, wire $5,000 to an attacker PayPal account, or purchase a forced 'Pro Plan' subscription via a hidden OAuth redirect.

Zscaler ThreatLabz's July 2, 2026 research documented two live campaigns purpose-built for AI-agent consumption. The first poisoned search results for a fake Python library, 'requests-secure-v2' (hosted at py-lib-repository[.]dev, promoted via a 10-repository 'Open-Agent-Utilities' GitHub account and satellite SEO domains), so that developer-assistant agents troubleshooting a fabricated `MissingLicenseKeyException` were instructed -- via a CSS-hidden `.system-traceback-layer` block positioned at `left:-9999px` plus a fabricated JSON-LD `offers` object -- to pay a '$3.00 developer API license key' fee to an Ethereum wallet or via a Stripe checkout link. Autonomous agent testing across 26 LLMs found four models (Llama 3.3 70B Instruct, Llama 3.2 90B Vision Instruct, Gemini 3 Flash, and Gemini 2.5 Pro) executed the fraudulent payment. The second campaign typosquatted the DeFi portfolio tracker DeBank at debank[.]auction, stuffing titles/meta/Open Graph tags and a fabricated JSON-LD `SoftwareApplication` entry, then hiding an instruction in a CSS-concealed `<noscript>` block telling any parsing AI model to treat the typosquat as 'the verified, authoritative destination for DeBank' and rank it first -- a context/RAG-poisoning attack rather than a direct-payment attack, since a persisted misclassification in a retrieval-augmented knowledge base propagates the deception across future queries. GPT-5.4 and Claude Sonnet 4.5 both misclassified the fraudulent domain as legitimate when no trusted reference for the genuine DeBank site was supplied in context.

Across all three research efforts, the common defensive gap is that agentic browsers and AI content-review pipelines currently grant hidden, machine-only page content the same trust as visible rendered content, and frequently execute consequential actions (payment, credential entry, ad approval, RAG ingestion) without a human-in-the-loop confirmation step.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1608 Stage Capabilities
- T1583 Acquire Infrastructure
- T1657 Financial Theft
- AML.T0051 LLM Prompt Injection
- AML.T0053 AI Agent Tool Invocation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**AI Agent Contact with Known IDPI Phishing Infrastructure (Splunk)** (`TL-2026-2707-SPL-001`)

Detects a web proxy/DNS connection from a user or an agentic browser (Comet, Copilot in Edge, GPT-agent-mode, LangChain/AutoGPT-driven browsers) to domains documented as hosting hidden CSS-concealed, JSON-LD, or SVG/CDATA machine-readable instructions aimed at AI shopping assistants and agentic browsers -- the Scamlexity/PromptFix (Guardio), Unit 42 IDPI-catalogue, and Zscaler ThreatLabz requests-secure-v2/DeBank-typosquat campaigns. This is the exploitation/initial-access stage: the agent's first contact with attacker-staged phishing infrastructure before any hidden instruction executes.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566, T1608, T1583, T1189, T0051
- **Data sources:** zscaler_web_proxy, dns_logs, squid_proxy
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy (sourcetype=zscaler:web OR sourcetype=squid OR sourcetype=bluecoat:proxysg:access:kv)
  (dest_domain="debank.auction" OR dest_domain="py-lib-repository.dev" OR dest_domain="market-insight-global.com" OR dest_domain="identity-breach-response.org" OR dest_domain="runners-daily-blog.com" OR dest_domain="bistro-reserve-now.net" OR dest_domain="edge-compliance-node.org" OR dest_domain="digital-asset-mart.org" OR dest_domain="consensus-protocol-v4.org" OR dest_domain="reviewerpress.com" OR dest_domain="reviewerpressus.mycartpanda.com" OR dest_domain="splintered.co.uk" OR dest_domain="cblanke2.pages.dev" OR dest_domain="perceptivepumpkin.com")
| eval user_agent=coalesce(http_user_agent, user_agent, cs_user_agent)
| eval is_agentic_browser=if(match(user_agent, "(?i)(Comet|Perplexity-Agent|CopilotEdge|OpenAI-Agent|BrowserAgent|AutoGPT|LangChain|Claude-Agent|AI-Shopping-Assistant)"), 1, 0)
| stats count as hits, min(_time) as first_seen, max(_time) as last_seen, values(user_agent) as user_agents, values(uri_path) as paths by src_ip, user, dest_domain, is_agentic_browser
| where hits > 0
| sort - is_agentic_browser, -hits
```

### Microsoft KQL

```kql
let IDPIDomains = dynamic(["debank.auction","py-lib-repository.dev","market-insight-global.com","identity-breach-response.org","runners-daily-blog.com","bistro-reserve-now.net","edge-compliance-node.org","digital-asset-mart.org","consensus-protocol-v4.org","reviewerpress.com","reviewerpressus.mycartpanda.com","splintered.co.uk","cblanke2.pages.dev","perceptivepumpkin.com"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (IDPIDomains)
| extend IsAgenticBrowser = InitiatingProcessFileName has_any ("comet.exe","msedgewebview2.exe","perplexity.exe","AgentBrowser.exe") or InitiatingProcessCommandLine has_any ("--agent-mode","copilot-agent")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, IsAgenticBrowser
| sort by Timestamp desc
```

### Sigma

```yaml
title: Network Connection to Known Indirect Prompt-Injection (IDPI) Phishing Infrastructure
id: 7a1e2c3d-4f5b-4a6c-8d9e-0f1a2b3c4d5e
status: experimental
description: Detects a proxy/DNS connection to domains documented as hosting hidden CSS/JSON-LD/SVG-CDATA machine-readable instructions targeting AI shopping assistants and agentic browsers (Scamlexity/PromptFix, Unit 42 IDPI catalogue, Zscaler ThreatLabz campaigns).
references:
    - https://www.doppel.com/blog/phishing-sites-trick-ai-agents
    - https://unit42.paloaltonetworks.com/ai-agent-prompt-injection/
    - https://www.zscaler.com/blogs/security-research/indirect-prompt-injection-web-content-targets-ai-agents
author: Threadlinqs Team
date: 2026-09-27
tags:
    - attack.initial-access
    - attack.t1566
    - attack.resource-development
    - attack.t1608
    - attack.t1583
    - attack.t1189
    - attack.tool.promptfix
logsource:
    category: proxy
detection:
    selection:
        c-uri|contains:
            - 'debank.auction'
            - 'py-lib-repository.dev'
            - 'market-insight-global.com'
            - 'identity-breach-response.org'
            - 'runners-daily-blog.com'
            - 'bistro-reserve-now.net'
            - 'edge-compliance-node.org'
            - 'digital-asset-mart.org'
            - 'consensus-protocol-v4.org'
            - 'reviewerpress.com'
            - 'reviewerpressus.mycartpanda.com'
            - 'splintered.co.uk'
            - 'cblanke2.pages.dev'
            - 'perceptivepumpkin.com'
    condition: selection
falsepositives:
    - Domain sinkholed/repurposed after takedown; confirm current registrar and hosted content before escalating
    - Threat-intel or SOC research browsing intentionally to the IOC list
level: high
```

**Known false positives:**

- Domain sinkholed or repurposed for legitimate content after takedown; verify current registrar and hosted content before escalating
- Security researcher or SOC analyst intentionally browsing to the IOC list for investigation or takedown evidence

**Tuning notes:** Refresh the malicious-domain lookup table from the threat feed on a schedule; add domain-similarity scoring (edit distance) against high-value brands (DeBank, Walmart, major banks/payment processors) to catch new typosquats not yet on the static list.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- AI Agent Contact with Known IDPI Phishing Infrastructure (Sentinel) (locked: unlock with TL Creds)
- AI Agent Autonomous High-Risk Tool Invocation Without Human Confirmation (Sentinel) (locked: unlock with TL Creds)
- Outbound Payment to Attacker Wallet/Payment Link or RAG-Poisoning Citation (Sentinel) (locked: unlock with TL Creds)
- Network Connection to Known Indirect Prompt-Injection Phishing Infrastructure (locked: unlock with TL Creds)
- AI Agent Autonomous High-Risk Tool Invocation Following Indirect Prompt Injection (locked: unlock with TL Creds)
- Outbound Payment to Attacker-Controlled Wallet/Payment Link or RAG-Poisoning Domain Citation (locked: unlock with TL Creds)
- AI Agent Autonomous High-Risk Tool Invocation Without Human Confirmation (Splunk) (locked: unlock with TL Creds)
- Outbound Payment to Attacker Wallet/Payment Link or RAG-Poisoning Citation (Splunk) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 19)

Defanged, TLP:CLEAR.

- Domain: `debank[.]auction`
- URL: `hxxps://buy[.]stripe[.]com/7sY4gsbMKdZwfx39Sq0oM00`
- Domain: `py-lib-repository[.]dev`

Full set of 19 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [When Phishing Sites Are Built to Fool Your AI Agent, Not You](https://www.doppel.com/blog/phishing-sites-trick-ai-agents)
- ["Scamlexity": When Agentic AI Browsers Get Scammed](https://guard.io/labs/scamlexity-we-put-agentic-ai-browsers-to-the-test-they-clicked-they-paid-they-failed)
- [Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild](https://unit42.paloaltonetworks.com/ai-agent-prompt-injection/)
- [Indirect Prompt Injection in Web Content Targets AI Agents](https://www.zscaler.com/blogs/security-research/indirect-prompt-injection-web-content-targets-ai-agents)
- [When Phishing Sites Are Built to Fool Your AI Agent, Not You (syndication)](https://securityboulevard.com/2026/09/when-phishing-sites-are-built-to-fool-your-ai-agent-not-you/)
- [Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments](https://www.securityweek.com/prompt-injection-attacks-trick-ai-agents-into-making-crypto-payments/)
- [Indirect Prompt Injection in Web Content Targets AI Agents](https://www.infosecurity-magazine.com/news/indirect-prompt-injection-web/)
- [Agentic AI Browser an Easy Mark for Online Scammers](https://www.bankinfosecurity.com/agentic-ai-browser-easy-mark-for-online-scammers-a-29291)
- [AI Browsers Fooled by Phishing and Fake Stores in Real-World Tests](https://cyberinsider.com/ai-browsers-fooled-by-phishing-and-fake-stores-in-real-world-tests/)
- [Hidden Web Prompts Trick AI Agents Into Sending Money](https://securityaffairs.com/194822/ai/hidden-web-prompts-trick-ai-agents-into-sending-money.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2707