Evidence · DiggingBeagle record
Unit 42 timely threat intelligence: indirect prompt injection investment-site campaign, 26 domains
- Published
- Nov 10, 2026
- Source role
- primary disclosure
Evidence record
Claim-level citations (3)
- supportsTwenty-six fake AI-trading sites attempted to turn search assistants into investment promoters: Unit 42 identified 26 apparently fraudulent AI-trading domains with hidden prompt-injection templates and an unfilled `naming_here` placeholder, without documenting completed investments or induced assistant outcomes.
2026-11-06 IDPI indicator report: NOTES, DETAILS and unfinished naming_here injection example
- supportsTwenty-six fake AI-trading sites attempted to turn search assistants into investment promoters: Unit 42 identified an indirect prompt-injection campaign on 26 domains posing as AI digital-asset trading platforms and carrying hidden HTML instructions for AI agents.
NOTES; DETAILS: detected 26 domains and hidden span tags
- supportsTwenty-six fake AI-trading sites attempted to turn search assistants into investment promoters: The same hidden template instructed agents to promote each host exclusively and still contained the unfilled literal naming_here placeholder.
DETAILS: example prompt and lines 319-344