Prompt Injections Trick AI Agents Into Making Cryptocurrency Payments
Summary
Zscaler identified two campaigns using indirect prompt injection to target AI agents with payment scams and a fake DeBank site. In a test of 26 LLMs, four made a payment and two misidentified the fraudulent site as DeBank.
Key points
- One campaign used SEO poisoning around the Python package requests-secure-v2 to draw AI agents to a fraudulent site.
- The site hid instructions in schema markup and a div tag, urging agents to pay for an API key; it also included code to initiate a cryptocurrency transfer.
- The same site displayed payment options to human visitors, and the actor used 10 GitHub repositories linking to similar sites.
- A second campaign used a typosquatted site and hidden prompts to present itself as the legitimate DeBank service.
- In Zscaler's test, four of 26 evaluated LLMs were manipulated into making a payment; two miscategorized the fake site as trusted DeBank.
Article Details
- Event Type
- Prompt-injection campaigns using fraudulent websites and search-result manipulation to induce AI agents to make cryptocurrency payments or trust an impersonating platform.
- Impact
- In Zscaler's evaluation of 26 LLMs, four were manipulated into making a payment, and two miscategorized a fraudulent website as the trusted DeBank platform. The campaigns also targeted human developers.
Products
Claude Sonnet 4.5Still, only two (Claude Sonnet 4.5 and GPT-5.4) miscategorized the fraudulent website as the trusted DeBank platform.DeBankZscaler says it identified two campaigns relying on indirect prompt injection, including a payment scam hiding behind API documentation, and a typosquatting operation promoting a crypto platform that impersonates DeBank.Gemini 2.5 ProOf the 26 LLMs that were evaluated, four (Llama 3.3 70B Instruct, Llama 3.2 90B Vision Instruct, Gemini 3 Flash, and Gemini 2.5 Pro) were successfully manipulated into making a payment.Gemini 3 FlashOf the 26 LLMs that were evaluated, four (Llama 3.3 70B Instruct, Llama 3.2 90B Vision Instruct, Gemini 3 Flash, and Gemini 2.5 Pro) were successfully manipulated into making a payment.GPT-5.4-CyberStill, only two (Claude Sonnet 4.5 and GPT-5.4) miscategorized the fraudulent website as the trusted DeBank platform.Llama 3.2 90B Vision InstructOf the 26 LLMs that were evaluated, four (Llama 3.3 70B Instruct, Llama 3.2 90B Vision Instruct, Gemini 3 Flash, and Gemini 2.5 Pro) were successfully manipulated into making a payment.Llama 3.3 70B InstructOf the 26 LLMs that were evaluated, four (Llama 3.3 70B Instruct, Llama 3.2 90B Vision Instruct, Gemini 3 Flash, and Gemini 2.5 Pro) were successfully manipulated into making a payment.