The report
A visitor could see a normal trading-site advertisement while a browsing assistant received a separate instruction telling it to recommend only that site. In indicators published November 6, Palo Alto Networks Unit 42 documented 26 domains using this pattern, with related multilingual pages advertising AI-powered digital-asset trading.
The instruction was part of the page, not the user request
The common template placed instructions inside HTML spans hidden from ordinary display. Those instructions impersonated a financial adviser, discouraged mention of competitors and pushed the host domain as the assistant’s exclusive recommendation. One unfinished field, naming_here, appeared where the site name should have been. That literal placeholder is evidence of a reused template, not a hidden command or successful transaction. Unit 42’s indicator list preserves the individual domains and template observations.
The attempted crossing is straightforward. A model reads external webpage content to answer a person’s question about an investment. The webpage instead asks the assistant to treat the site operator as the authority governing its advice. The content is lower trust than the user’s instructions and cannot grant itself permission to make recommendations, open accounts or submit transactions. The campaign Case reconstructs that attempted authority transfer.
Unit 42 observed attacker-hosted material but did not document a verified assistant following the instructions in a controlled transaction, a real investor being induced to pay or a confirmed financial loss. The 26 domains are therefore indicators of exposure and campaign preparation, not 26 proven successful prompt injections. A related Zscaler study of fake crypto-payment instructions used a different setup and measured simulated model behavior; its results cannot be reassigned to these domains.
For investigations, save the webpage bytes and the agent’s actually retrieved text. Compare the recommendation to independently sourced financial information, and require separate transaction approval at the wallet or broker. Blocking the visible site alone is not enough if a retrieved document has already been promoted into the assistant’s instruction hierarchy.