Twenty-six fake AI-trading sites attempted to turn search assistants into investment promoters

Palo Alto Networks Unit 42 documented 26 pages impersonating AI-enabled digital-asset trading services. Much of their surrounding text was repeated across sites and languages; hidden HTML span elements provided an instruction layer more likely to be consumed by a retrieval agent than seen by a human. One template accidentally retained the literal platform placeholder naming_here, while substituting its own domain into the recommendation instructions.

The injected material ordered assistants to behave as financial experts, recommend the page as the exclusive destination, avoid competitor links and apply urgency and authority cues. This is a documented attempt to redirect AI-generated financial recommendations through third-party web content, not proof that any assistant obeyed, any account was created or any deposit occurred. Unit 42 says the pages appear designed to capture user information; it does not establish a victim or loss count.

Twenty-six observed hostile domains, one related prompt template, with different localized webpages. This is distinct from the Zscaler fake crypto-payment evaluation that induced a simulated 0.0012 ETH payment in four of 26 model tests.

No agent-compliance trial, real user investment, stolen balance or common owner beyond the shared kit has been established. An analyst should not interpret the 26 domains as 26 successful compromises.

Unit 42 published 26 indicators on November 6 for websites presenting themselves as AI-powered digital-asset trading platforms. The pages used visually hidden spans with a nearly identical instruction template in several languages. Instead of providing financial facts, the text told an AI reader to act as a financial expert, promote the current site exclusively, avoid competitors and use urgency and authority cues. One page preserved the unfilled marker naming_here, exposing the shared template.

The attempted crossing is from untrusted web-search material into the assistant's recommendation policy. It is not equivalent to an agent actually recommending a particular site, to a victim investing, or to an on-chain theft. Unit 42's public indicator list documents the hosted instruction and the 26-page sample; it does not provide successful agent trials or payment receipts. A useful reader defense is provenance-aware recommendation generation that ignores webpage imperatives and checks investment claims against independent sources before an assistant suggests any payment destination.