AI Security Briefing

What it is

Zscaler ThreatLabz's breakdown of a live indirect prompt injection (IPI) payment scam that impersonates a Python package (requests-secure-v2) to trick web-enabled AI agents into paying an attacker. The summary states the outcome; what's actionable here are the concrete IOCs and the specific DOM/schema patterns to detect.

How it works

The site poses as API documentation and is elevated via SEO poisoning so agents hit it when troubleshooting requests-secure-v2. The injection is layered:

• JSON-LD structured data declares the site a SoftwareApplication with an offers object claiming a $3.00 developer API license key is needed to resolve a MissingLicenseKeyException, plus a Stripe checkout link. The page notes agents often treat structured metadata as higher-signal than free-form HTML, which boosts injection success.
• CSS-hidden DOM content: a .system-traceback-layer element positioned off-screen (left: -9999px) carries the same "pay to resolve the error" instructions — invisible to humans, fully readable to parsers/agents.
• Crypto fallback: JavaScript initiates a transfer of ~0.0012 ETH to a hardcoded wallet, then generates a fake API key to display.

Indicators

• ETH wallet: 0x691bc3793205e574fa7b4aa068e62c0e470ad267 (per ThreatLabz, has received larger prior payments — likely reused).
• GitHub repo Open-Agent-Utilities; the actor runs 10 GitHub repos linking to similar IPI sites.
• Fake package name: requests-secure-v2.

Preconditions / Affected

Matters only for autonomous, web-browsing agents that fetch and act on page content (installing packages, resolving errors, initiating payments). A human in a normal browser sees an ordinary payment page; the risk is the agent acting on hidden/structured instructions unprompted. In Zscaler's 26-LLM test, 4 models took inappropriate actions on this campaign.

What to do

The page gives no patch — the actionable defenses are inferable detections from the disclosed mechanics:

• Strip or sandbox off-screen/hidden DOM (left:-9999px, zero-size, display:none) before feeding page content to an agent.
• Treat JSON-LD offers/SoftwareApplication payment fields as untrusted input, not authoritative instructions — do not let schema markup drive payment actions.
• Block the ETH address and the Open-Agent-Utilities repos as IOCs.
• Require human approval before any agent-initiated payment or crypto transfer.

Caveats

The trust-prioritization of structured data over HTML is described as "a general tendency rather than a characteristic specific to any single implementation" — effectiveness varies by agent. The fetched text cuts off partway into Campaign 2 (the crypto typosquatting campaign), so its details here come only from the summary, not the article body.