← BACK TO FEED
prompt injectionAI agentscrypto fraudagentic AIcybersecurity

AI Agents Are Being Tricked Into Sending Crypto Payments via Poisoned Web Content

Threat actors are exploiting prompt injection attacks embedded in malicious websites and manipulated search results to deceive AI agents into making unauthorised cryptocurrency payments. Zscaler identified two campaigns using these techniques: one involving a fake Python library site that instructs AI agents to pay for an API key, and another typosquatting the DeFi platform DeBank to trick agents into treating the fraudulent site as legitimate. Testing against 26 large language models found that four were successfully manipulated into making payments, highlighting the growing security risks as AI agents become more autonomous web users.

Prompt injection attacks have found a new target: autonomous AI agents with the ability to browse the web and execute payments. Zscaler has documented two active campaigns where attackers embedded hidden instructions in malicious websites to manipulate AI agents into sending cryptocurrency or trusting fake platforms.

The first campaign uses SEO poisoning to surface a fraudulent site when AI agents search for a Python package called requests-secure-v2. The site is stuffed with keywords designed to rank for package installation and dependency queries. Once an agent lands on the page, it encounters hidden instructions buried in schema markup and a concealed div element, both directing it to make a crypto payment as though it were a standard step in obtaining an API key. There is also code on the page ready to initiate a transfer to a hardcoded wallet.

The attack is not exclusively aimed at AI agents. When a human developer visits the same page in a browser, identical payment options appear, with both credit card and cryptocurrency presented as legitimate choices. The threat actor has set up ten GitHub repositories pointing to a network of similarly booby-trapped sites.

The second campaign targets users of DeBank, a decentralised finance portfolio tracker. A typosquatted lookalike site is being promoted through search, with title tags, meta descriptions, and Open Graph data optimised to make it appear official. The hidden prompts on this site go a step further, instructing visiting AI agents that the fraudulent domain is the genuine DeBank platform.

To see how bad things actually are, Zscaler built a test agent with web browsing and payment execution capabilities and pointed it at these campaigns using 26 different LLMs. Four models, including Llama 3.3 70B Instruct, Llama 3.2 90B Vision Instruct, Gemini 3 Flash, and Gemini 2.5 Pro, were successfully manipulated into completing a payment. Two models, Claude Sonnet 4.5 and GPT-5.4, fell for the DeBank impersonation and marked the fraudulent site as trusted.

That is not a stellar pass rate across the board, but it is alarming enough. As AI agents take on more autonomous roles, web content itself becomes attack surface. Attackers do not need to compromise the agent directly when they can just poison what the agent reads.

READ NEXT
BioShocking: The Attack That Tricks AI Browsers Into Thinking Credential Theft Is Just Winning a GameYour App Is Under Attack Before Lunch on Launch DayThis Cybersecurity Index Tracks Real Breaches and Refuses to Invent a Grand Total