THREAT actors are exploiting prompt injection attacks through malicious websites to trick AI agents into making payments to fraudulent cryptocurrency platforms. Zscaler identified two campaigns using indirect prompt injection: one promoting a payment scam through API documentation targeting AI agents and the other impersonating the crypto tracker DeBank using typosquatting techniques.
The first campaign utilized SEO poisoning to alter search results, while the second campaign's website was designed to appear legitimate by including relevant keywords and metadata. Zscaler's tests revealed that some AI agents were successfully manipulated into making payments, highlighting the risks posed by AI becoming a mainstream web interface.