Malicious Websites Hide Prompt Instructions in DOM to Poison AI Agent Decision-Making

Zscaler ThreatLabz uncovered two campaigns that weaponize web content against AI workflows via Indirect Prompt Injection and DOM poisoning: a fake Python package documentation site elevated by SEO poisoning that hides instructions to steal small payments, and a DeBank typosquatting site that injects prompts to contaminate RAG and rank the malicious site as authoritative; the report details technical TTPs (JSON-LD abuse, off-screen CSS, metadata fabrication), includes domain IOCs, and notes model-dependent susceptibility.