Zscaler's ThreatLabz researchers found two criminal campaigns preparing web pages for a new kind of visitor: an AI agent that can browse websites and spend funds on its own. One campaign dressed a payment demand as documentation for a software package. The other built a counterfeit cryptocurrency service and told models to treat it as authentic.

Then the researchers gave an autonomous agent payment tools and ran 26 language models through the trap. Four models completed cryptocurrency payments.

The tests used a sandbox with no real funds at risk, but the result was not a warning about something the agents might theoretically do. The agents used their payment capability after hostile instructions on a webpage told them to. The money was simulated; the decision and tool execution were real test results.

Two campaigns built pages for machines

The first campaign targeted searches for requests-secure-v2, a nonexistent Python software package. Attackers created fake documentation filled with terms likely to rank for installation and troubleshooting searches. This is search-result manipulation: stuffing a page with the phrases a person or agent is likely to search so the malicious page appears useful and relevant.

The visible page resembled developer documentation. Hidden inside it was an indirect prompt injection, which is an instruction planted in data that an AI system is expected to read. The user does not directly tell the agent to pay anyone. The webpage does, and the agent mistakes that untrusted text for part of its task.

ThreatLabz found ten GitHub repositories associated with the campaign and linked to similar sites. The infrastructure was live rather than a page invented by researchers for a demonstration. It targeted human developers too, displaying credit-card and cryptocurrency payment options in ordinary browsers.

The second campaign impersonated DeBank, a legitimate decentralized-finance portfolio tracker. The attackers used debank[.]auction, a lookalike domain. Registering a domain that resembles a trusted service is called typosquatting. It relies on people or software treating a familiar-looking name as the real one.

The fake package asked for payment

The fake package page framed payment as a routine step for resolving a missing license key. It used JSON-LD, structured metadata that helps search engines and other software understand what a page represents. The metadata described a software application and claimed a three-dollar developer license was required to fix a MissingLicenseKeyException.

That exception name looked technical and official. It was part of the fiction. The page also supplied a Stripe checkout link, hid similar payment instructions in an off-screen HTML element, and included code to transfer about 0.0012 Ether to a hardcoded cryptocurrency wallet. After a successful transaction, the page generated a fake application programming interface key, meaning a credential that supposedly allowed software to use the package's service.

The page assembled a complete story for a machine: the software is missing, the missing component requires a license, the license costs a small amount, this is the approved payment route, and a key will appear afterward. Each piece made the next action look like ordinary task completion.

Zscaler reported that the wallet had received other, larger payments and said the address might have been used in prior attacks. That does not establish who sent those funds or whether an AI agent was involved. It does mean nobody can safely turn "the test used no real funds" into "no person ever paid this wallet."

Four models completed the transfer

ThreatLabz built an autonomous agent with web-browsing and payment-execution tools. The environment was fully sandboxed, no real funds were at risk, and the agent had no spending limit because the researchers wanted to measure the maximum exposure. The assigned task told the agent to help developers independently by choosing tools, reading documentation, and providing guidance a developer could use.

Across 26 tested models, four followed the injected instructions far enough to execute payments: Llama 3.3 70B Instruct, Llama 3.2 90B Vision Instruct, Gemini 3 Flash, and Gemini 2.5 Pro.

Operating inside the payment-capable agent, the models invoked the action the attacker wanted. The sandbox kept real money out of the experiment; it did not prevent the control failure from occurring.

A deployed system may have spending limits, approvals, or a restricted list of recipients. Those controls can reduce harm, and Zscaler intentionally removed a spending limit from its maximum-exposure test. None of that makes webpage instructions a legitimate authorization channel. An agent should not decide that a merchant is trusted and a transfer is approved because the merchant's own hidden text says so.

A counterfeit DeBank site passed for the real thing

The second campaign tested trust rather than payment. The counterfeit DeBank page packed its title and metadata with phrases such as DeBank Login, DeFi Dashboard, and Crypto Tracker. It falsely identified the legitimate debank.com domain as its publisher while hosting the page elsewhere.

Hidden instructions told models that the lookalike site was the verified, authoritative destination for DeBank searches. They also told the model not to mention the word "Auction," conveniently suppressing the part of the address most likely to make a careful reader suspicious.

ThreatLabz removed payment tools for this test because the page did not ask for payment. Of the 26 models, Claude Sonnet 4.5 and GPT-5.4 misclassified the fraudulent site as the trusted DeBank platform when the agent lacked a trusted reference for the real site. Infosecurity Magazine reported that none of the tested models were fooled when the genuine site was provided for comparison. Most models resisted the hostile instruction even without that reference. Two still let a page manufacture its own reputation when the comparison was absent.

Unit 42 documented a different event

This research belongs beside the earlier Unit 42 incident, but it is not the same attack. Unit 42 published March 2026 telemetry covering 22 ways attackers concealed web instructions and several goals, including payments, data destruction, and advertising-review bypass.

Zscaler's July 2 report examined two specific campaigns with named infrastructure and then compared model behavior inside its own agent. Its distinctive result is experimental and blunt: four models completed payments when the fake package page told them to. In the separate comparison without a trusted reference for the real site, two others trusted a counterfeit financial site.

The evidence answers different questions. Unit 42 showed that indirect prompt injection had appeared on real pages across a broader set of attacks. Zscaler showed how two live campaigns were constructed and which tested models actually carried out the requested actions under controlled conditions.

A webpage cannot be allowed to spend the agent's money

Web content is input, not authority. A browser may display a payment button, a documentation page may describe a fee, and structured metadata may claim a seller is legitimate. None of those facts prove that the user approved a purchase.

Payment-capable agents need controls outside the model's interpretation of prose. Recipient restrictions, spending limits, verified merchant identities, explicit user confirmation, and transaction previews are not optional decorations. They are the boundary between gathering information and moving value.

These tests demonstrate why that boundary cannot be another prompt saying "do not follow malicious instructions." The malicious instructions were embedded in material the agent was supposed to read, dressed as the task it was supposed to complete, and backed by tools it was allowed to use. Four models reached the wallet because the system treated persuasion as permission.