Prompt Injection Attacks Trick AI Agents Into Making Cryptocurrency Payments, Zscaler Warns

` tag told agents to resolve an error by completing the payment. The page also included code to initialize a cryptocurrency transfer to a hardcoded wallet. The threat actor behind the campaign is using 10 GitHub repositories linking to multiple similar websites containing indirect prompt injections.

Crucially, the site targets both machines and humans. "When the website is rendered by a desktop browser, the same payment options via credit card or cryptocurrency are displayed to the user," Zscaler noted.

Campaign Two: Impersonating DeBank

In the second campaign, a threat actor promoted a fraudulent website typosquatting the DeFi portfolio tracker DeBank. The indirect prompts used tell the AI agents that the impersonating website is the legitimate DeBank domain. The fraudulent site is optimized to rank for DeBank-related searches by stuffing the title and meta tags with keywords such as "DeBank Login," "DeFi Dashboard," and "Crypto Tracker," and it includes Open Graph and X (formerly Twitter) metadata so the link appears to be an official DeBank service.

To test the campaigns' impact, Zscaler built an autonomous AI agent with web-browsing and payment-execution capabilities and evaluated it against 26 large language models. Four of them — Llama 3.3 70B Instruct, Llama 3.2 90B Vision Instruct, Gemini 3 Flash, and Gemini 2.5 Pro — were successfully manipulated into making a payment. Only two, Claude Sonnet 4.5 and GPT-5.4, miscategorized the fraudulent website as the trusted DeBank platform.

Why Indirect Prompt Injection Is Hard to Solve

Indirect prompt injection is considered one of the thorniest security problems in generative AI because the malicious instruction does not arrive as a direct user request. Instead, it is embedded in the data — a web page, a document, an email — that an agent retrieves and processes as part of its workflow. The agent cannot easily distinguish a legitimate instruction in retrieved content from an attacker's planted command, because both look like ordinary text.

The Zscaler findings show how that ambiguity becomes dangerous once agents are granted the ability to take real-world actions such as initiating payments. A scam that once required social engineering aimed at a human can now be encoded directly into web content, waiting for an automated assistant to read and act on it.

"As AI agents become a more common interface to the web, the content itself is going to become a larger attack surface, highlighting that AI is a double-edged sword that can streamline workflows while also introducing new avenues for abuse," Zscaler concluded.

Implications for Enterprises and Developers

The research carries direct lessons for organizations deploying agentic AI. Granting agents payment, account-creation, or data-sharing capabilities without strict human-in-the-loop confirmation creates a path for attackers to monetize compromised web content. Zscaler's testing suggests susceptibility varies widely by model, meaning that model choice and the guardrails layered on top of it both matter.

The work also reinforces that traditional web security hygiene — verifying package authenticity, scrutinizing typosquatted domains, and treating unsolicited payment requests with suspicion — now intersects with AI behavior. As agents increasingly browse, summarize, and act on web content on behalf of users, the line between a compromised website and a compromised assistant is disappearing.

Stay Ahead of AI

For ongoing coverage of AI safety, security research, and the risks emerging from agentic systems, follow AI Buzz Wire for the developments shaping responsible artificial intelligence.

Read more AI ethics news →