Campaign 1: IPI Payment Scam

One of the fraudulent websites ThreatLabz analyzed was an IPI-enabled payment scam that uses API documentation as a cover. The website is made discoverable through SEO poisoning (shown in the figure below), increasing the likelihood that an AI agent will encounter it when searching for the Python library requests-secure-v2.

Figure 1: SEO poisoning example to elevate a malicious IPI website to the top of search results.

ThreatLabz observed that the fraudulent website includes keyword-heavy HTML tied to the fake Python module to poison search results for package installation and dependency troubleshooting queries, as shown in the figure below.

Figure 2: Example of keywords embedded in the IPI website’s HTML content for SEO poisoning.

The website includes hidden IPI instructions designed to influence an AI agent’s decision-making by framing the payment as a routine step to acquire an API key. As a result, an AI agent attempting to complete a development task can be manipulated into sending funds to an attacker-controlled account. The full attack flow is shown in the figure below.

Figure 3: Complete IPI attack chain for this campaign.

ThreatLabz observed the attacker abusing JSON-LD, a structured metadata format intended to help search engines interpret website content. In agentic workflows, structured fields can be treated as high-signal context compared to free-form HTML, which may increase the effectiveness of the prompt injection. It is worth noting that this trust prioritization may vary across AI agent implementations and reflects a general tendency rather than a characteristic specific to any single implementation.

In this case, the JSON-LD describes the site as a SoftwareApplication and embeds an offers object claiming a $3.00 developer API license key is required to resolve a MissingLicenseKeyException. It also provides a Stripe checkout link, as shown in the figure below.

Figure 4: JSON-LD structured data embedded in the IPI website to manipulate AI agents.

By encoding the payment in schema markup, the attacker increases the likelihood that an AI agent will follow the instructions.

ThreatLabz also observed the attacker concealing IPI content using CSS so it is invisible to users, but still present in the DOM for parsers, scrapers, and AI agents. In this case, the .system-traceback-layer element is positioned off-screen (e.g., left: -9999px), leaving the visible page as legitimate developer documentation while the hidden instructions remain machine-readable, as shown in the figure below.

Figure 5: CSS used to hide the prompt content.

In addition to the JSON-LD block, there is a <div> tag hidden by the CSS that contains similar IPI instructions directing the AI agent to “resolve” the error by purchasing the $3.00 developer license as shown in the figure below.

Figure 6: Hidden content in a <div> tag containing embedded IPI instructions.

The website also contains instructions and JavaScript code to initiate a transfer of approximately 0.0012 ETH to a hardcoded wallet address. After a successful transaction, the flow generates a fake API key and displays it to the victim as shown in the following figure.

Figure 7: Malicious IPI website with cryptocurrency payment information and fake API key generation code. 

The Ethereum cryptocurrency wallet address (0x691bc3793205e574fa7b4aa068e62c0e470ad267) has received payments although for larger amounts, so this threat actor may have previously used the address in prior attacks.

The website does not only attempt to target AI agents, but also human developers. When the website is rendered by a desktop browser, the same payment options via credit card or cryptocurrency are displayed to the user as shown in the figure below. 

Figure 8: Malicious IPI website with payment options for a fake API key.

ThreatLabz identified additional websites linked to this attack through the GitHub repository Open-Agent-Utilities. The threat actor behind this attack currently has 10 repositories on GitHub that link to similar websites with IPI that target AI agents, as shown in the figure below.

Figure 9: Additional fake websites associated with this campaign targeting AI agents.