Hackers Abuse SEO Poisoning and Hidden HTML to Trick AI Agents Into Following Malicious Instructions

Zscaler researchers observed two campaigns abusing search-engine optimization and hidden JSON-LD to perform indirect prompt injection against AI agents: one impersonated a fake Python package docs page to prompt a $3 fraudulent license payment, and the other used a typosquatted DeBank domain to trick models into treating the site as authoritative. The report includes multiple malicious domains, associated GitHub repositories, an Ethereum wallet address used to collect payments, and recommends layered security controls to detect hidden injection patterns.