[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqrhmqlPjllm2iv1e7s532UF8NfTuXyu4EBxp7UBxlL8":3},{"article":4,"iocs":53,"watch_terms":57,"solutions":58,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"3ed0f2b4-bb39-4672-9d3f-40639963a369","Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments","prompt-injection-attacks-trick-ai-agents-into-making-crypto-payments-679505","Researchers uncovered two campaigns embedding indirect prompt injections in malicious websites to exploit autonomous AI agents browsing the web. The post Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments appeared first on SecurityWeek.","Threat actors are exploiting autonomous AI agents through indirect prompt injection attacks on malicious websites and manipulated search results. Two campaigns identified by Zscaler involve a payment scam hidden within API documentation and a typosquatting operation impersonating the DeBank crypto platform. Researchers successfully manipulated several LLMs into making crypto payments or misidentifying fraudulent sites as legitimate.","AI agents tricked into crypto payments via prompt injection on malicious websites.","https:\u002F\u002Fwww.securityweek.com\u002Fprompt-injection-attacks-trick-ai-agents-into-making-crypto-payments\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F01\u002FCybersecurity_News-SecurityWeek.jpg","2026-07-06T11:19:47+00:00","2026-07-06T12:00:20.034314+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Llama 3.3 70B Instruct","product",{"name":21,"type":19},"Llama 3.2 90B Vision Instruct",{"name":23,"type":19},"Gemini 3 Flash",{"name":25,"type":19},"Gemini 2.5 Pro",{"name":27,"type":19},"Claude Sonnet 4.5",{"name":29,"type":19},"GPT-5.4","839da5c1-3c34-47e2-9499-f7201640e3ac",{"id":30,"icon":32,"name":33,"slug":34},null,"AI Security","ai-security",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":47,"value":55,"context":56},"requests-secure-v2","Fake Python module used in SEO poisoning campaign.",[18,21,23],{"controls":59,"vendors":140},[60,89,114],{"slug":61,"name":62,"problem":63,"products":64},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"slug":34,"name":90,"problem":91,"products":92},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":110,"product_name":111,"url":112,"description":113},"prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"slug":115,"name":116,"problem":117,"products":118},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[119,124,132],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":120,"product_name":121,"url":122,"description":123},"cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",[141],{"slug":142,"name":143,"logo_path":144,"roles":145},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png",[146],"reported_by",{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":163},"prompt-injection-attacks-hijack-ai-agents-to-steal-crypto","Prompt Injection Attacks Hijack AI Agents to Steal Crypto","Threat actors are exploiting a fundamental trust gap in autonomous AI agents by embedding malicious instructions into websites, API documentation, and typosquatted domains — a technique known as indirect prompt injection. Because these AI agents are designed to act on retrieved content without sufficiently verifying its intent or origin, they can be manipulated into executing unauthorized financial transactions. This matters because as organizations deploy AI agents with real-world capabilities (e.g., making payments, accessing APIs), the attack surface expands dramatically beyond traditional software vulnerabilities. The deceptive use of typosquatting and poisoned documentation shows attackers are already actively targeting AI-integrated workflows, not just theoretical models.",[152,153,154,155,156,157,158,159,160,161,162],"NIST AI RMF - GOVERN 1.1 (AI risk policies)","NIST AI RMF - MEASURE 2.5 (AI system monitoring)","NIST SP 800-53 AC-6 (Least Privilege)","NIST SP 800-53 SI-10 (Information Input Validation)","NIST SP 800-53 AU-12 (Audit Record Generation)","CIS Control 3 (Data Protection)","CIS Control 6 (Access Control Management)","CIS Control 8 (Audit Log Management)","OWASP LLM Top 10 - LLM01 (Prompt Injection)","OWASP LLM Top 10 - LLM09 (Overreliance on LLM Output)","MITRE ATLAS AML.T0051 (LLM Prompt Injection)",{}]