Hidden Website Instructions Target AI Agents in Two Prompt-Injection Campaigns
Summary
Zscaler ThreatLabz describes two campaigns using hidden website instructions and SEO poisoning to manipulate AI agents, and reports that some of 26 tested LLMs mishandled the sites.
Key points
- ThreatLabz identified two campaigns embedding indirect prompt-injection instructions in websites to influence AI agents.
- The campaigns combined SEO poisoning with CSS and HTML techniques to conceal instructions and manipulate search results.
- One campaign involved a payment scam; the other impersonated a cryptocurrency platform through typosquatting.
- In testing across 26 LLMs, four models failed to take appropriate actions for the first campaign, while two misclassified the site in the second.
- The researchers warn that agents treating malicious websites as legitimate can face context contamination and downstream RAG-poisoning risks.
- The article lists domains and associated GitHub links as indicators of compromise.
Article Details
- Attack Vectors
- Indirect prompt injection embedded in website content to influence AI-agent reasoning during task execution.
- SEO poisoning combined with CSS/HTML abuse to manipulate search results and conceal prompt-style instructions.
- Impersonation websites used in a payment scam and a typosquatting campaign impersonating a cryptocurrency platform.
- Defensive Notes
- Zscaler reports detecting indicators related to the threats through its multilayered cloud security platform.
- In internal validation across 26 LLMs, 4 models failed to take appropriate actions for campaign 1, and 2 models failed to accurately classify the website in campaign 2.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bistro-reserve-now[.]net | Listed as an IOC for a malicious website involved in the reported campaigns. |
| DOMAIN | consensus-protocol-v4[.]org | Listed as an IOC for a malicious website involved in the reported campaigns. |
| DOMAIN | debank[.]auction | Listed as an IOC for the typosquatting campaign impersonating a cryptocurrency platform. |
| DOMAIN | digital-asset-mart[.]org | Listed as an IOC for a malicious website involved in the reported campaigns. |
| DOMAIN | edge-compliance-node[.]org | Listed as an IOC for a malicious website involved in the reported campaigns. |
| DOMAIN | identity-breach-response[.]org | Listed as an IOC for a malicious website involved in the reported campaigns. |
| DOMAIN | market-insight-global[.]com | Listed as an IOC for a malicious website involved in the reported campaigns. |
| DOMAIN | py-lib-repository[.]dev | Listed as an IOC for a malicious website involved in the reported campaigns. |
| DOMAIN | runners-daily-blog[.]com | Listed as an IOC for a malicious website involved in the reported campaigns. |
| DOMAIN | visual-media-rights-group[.]org | Listed as an IOC for a malicious website involved in the reported campaigns. |
| HOSTNAME | permits[.]global-transit-authority[.]org | Listed as an IOC for a malicious website involved in the reported campaigns. |