Web content that makes agents pay: indirect injection in the wild

What is this?

On July 2, 2026, Zscaler ThreatLabz published an analysis of two real-world campaigns that hide instructions inside ordinary-looking web pages to manipulate autonomous AI agents — the kind that browse the web and can take actions like installing a package or sending a payment. This is indirect prompt injection (IPI): the attacker does not talk to the model directly, they plant instructions in content the agent will read and wait for the agent to treat that content as if it were a command.

What makes these campaigns notable is that they are not a lab demo. They are running in the wild, they target agents specifically, and one of them ends in money leaving a wallet. The reporting was echoed by SecurityWeek, Crypto Briefing and Infosecurity Magazine over the following days.

How it works

The first campaign impersonates a Python package. The attacker stands up a documentation-style page for a non-existent library, then uses SEO poisoning — keyword-heavy HTML tied to the fake module name — so the page surfaces when an agent searches for install or dependency-troubleshooting help. Once the agent lands on the page, the injected instruction tells it that acquiring a “developer API key” requires a small payment (framed as roughly $3, encoded on-chain as a fraction of ETH) sent to a hardcoded wallet.

Three delivery tricks stack on top of each other:

Layer            Purpose
---------------  -------------------------------------------------------
SEO poisoning    Get the page in front of the agent in the first place
CSS-hidden DOM   Instructions invisible to humans (e.g. off-screen
                 positioning) but fully present for parsers and agents
JSON-LD schema   A structured "offers" object that frames the payment as
                 a legitimate, machine-readable licensing step

The instruction itself is [REDACTED] here — the point is the mechanism, not the script. The page also renders normal credit-card and crypto payment options to a human visitor, so it doubles as a classic scam page. Zscaler links the operation to a cluster of GitHub repositories pointing at similar sites.

The second campaign is quieter but arguably worse. A typosquatted domain impersonates a well-known DeFi portfolio tracker, then stuffs its title, meta tags, Open Graph and social-card metadata with the real brand’s keywords. Injected text asserts to any reading agent that this fraudulent domain is the legitimate one. There is no payment step — the goal is to get the agent to endorse the fake site as trusted, and let the victim take it from there.

To measure impact, Zscaler built an agent with browsing and payment-execution capability and pointed it at both lures across 26 models. Four were manipulated into actually sending the fraudulent payment, and two others endorsed the typosquatted site as the genuine platform. No model was uniformly immune, and susceptibility varied widely between families.

Why it matters

The dollar amount is deliberately trivial. The structural lesson is not: retrieved web content is now an execution surface. An agent that can pay, install, or click treats the page it reads as data and as a potential instruction, and today’s models do not reliably keep that boundary. The same pattern that sends 0.0012 ETH scales to approving a transaction, exfiltrating a secret, or installing a poisoned dependency.

Two properties make this dangerous at scale. First, it is passive: the attacker publishes a page and waits, with SEO doing the targeting. Second, it is invisible to the human in the loop — CSS hides the payload, and an “autonomous” or “act-without-asking” agent removes the human entirely. The typosquatting variant shows the softer edge of the same problem: even without a payment, an agent that vouches for a malicious site launders attacker trust into user trust.

Defenses

There is no model-side patch that closes this, so defense is architectural.

Keep a hard trust boundary between the agent’s instructions and any content it retrieves: treat web pages, docs and search snippets as untrusted data, never as commands. Parse the full rendered DOM including CSS-hidden and off-screen nodes and structured metadata (JSON-LD, Open Graph), and flag pages where hidden text diverges from what a human sees. Gate any consequential action — payments, transfers, package installs, credential use — behind explicit, least-privilege authorization and human confirmation; an agent with a funded wallet and “act without asking” is a standing liability. Constrain payments with allowlisted recipients and hard spending caps rather than trusting the agent’s judgment on a per-page basis. For brand and domain trust, verify against an allowlist of known-good domains instead of letting a page assert its own identity. Finally, log and review the agent’s tool calls and outbound transactions so a poisoned action is caught after the fact even if it slips through — and feed known indicators (below) into blocklists.

Status

Item	Detail
Disclosed	Zscaler ThreatLabz, July 2, 2026
In the wild	Yes — two active campaigns, plus ~10 linked GitHub repos
Models tested	26; 4 executed the payment, 2 endorsed the fake site
Fix	No single patch — mitigations are architectural (see Defenses)
Indicators	Fake package requests-secure-v2; typosquat debank[.]auction; wallet 0x691bc3793205e574fa7b4aa068e62c0e470ad267