{
  "Event": {
    "analysis": "1",
    "date": "2026-03-03",
    "extends_uuid": "",
    "info": "[Threat Intel] Web-Based Indirect Prompt Injection Observed in the Wild: Fooling AI Agents",
    "protected": false,
    "publish_timestamp": "1772824058",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1772824058",
    "uuid": "3ae0456a-707a-4f43-bad3-0c909e83f841",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0afe32",
        "local": false,
        "name": "misp-galaxy:producer=\"Palo Alto\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005c",
        "local": false,
        "name": "rectifyq:topic=\"ai\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772593230",
        "to_ids": false,
        "type": "link",
        "uuid": "2dade638-4a86-4f88-a3dd-f4efb24d671b",
        "value": "https://unit42.paloaltonetworks.com/ai-agent-prompt-injection/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772593230",
        "to_ids": false,
        "type": "text",
        "uuid": "c54245b4-c133-4bab-a816-27aced1b097b",
        "value": "This article analyzes real-world instances of indirect prompt injection (IDPI) attacks targeting AI agents and large language models integrated into web systems. The researchers identify 22 distinct techniques used by attackers to embed malicious prompts in webpages, including visual concealment, obfuscation, and dynamic execution methods. They categorize attacker intents ranging from low-severity disruptions to critical data destruction attempts. Notable findings include the first observed case of AI-based ad review evasion and attempts at search engine optimization manipulation. The article presents a taxonomy of web-based IDPI attacks and provides insights into attack trends based on telemetry data. The researchers emphasize the need for proactive, web-scale defenses to detect IDPI and distinguish between benign and malicious prompts."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772593230",
        "to_ids": false,
        "type": "text",
        "uuid": "a1e5292d-fd14-4b0e-ad2d-d1427fa47a52",
        "value": "Name: Web-Based Indirect Prompt Injection Observed in the Wild: Fooling AI Agents\nAuthor: AlienVault\nAdversary: \nTags: [\"prompt engineering\", \"ai security\", \"ai agents\", \"llm vulnerabilities\", \"web attacks\", \"indirect prompt injection\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: []\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772810590",
        "to_ids": true,
        "type": "url",
        "uuid": "f7de2fde-7801-438c-8477-a9f5f1d44ffb",
        "value": "http://ericwbailey.website/published/accessibility-preference-settings-information-architecture-and-internalized-ableism",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772810612",
        "to_ids": true,
        "type": "url",
        "uuid": "7f1b1ecc-c873-4cfa-b6cd-6c13fc900036",
        "value": "http://reviewerpress.com/advertorial-maxvision-can/?lang=en",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772810634",
        "to_ids": true,
        "type": "url",
        "uuid": "b975f197-cce7-4686-a3c9-00709b3763b9",
        "value": "http://storage3d.com/storage/2009.11",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772810656",
        "to_ids": true,
        "type": "url",
        "uuid": "aa775ef2-f038-432f-bf12-77848005f8c0",
        "value": "http://token.llm7.io/?subscription=show",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772810679",
        "to_ids": true,
        "type": "domain",
        "uuid": "27276247-6b99-439b-982b-bc11c0d01b86",
        "value": "1winofficialsite.in",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772821874",
        "to_ids": true,
        "type": "domain",
        "uuid": "5cebd140-b90f-455e-b97f-e5bf28cb4470",
        "value": "dylansparks.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772821897",
        "to_ids": true,
        "type": "domain",
        "uuid": "77aec73f-1ee0-44aa-a81c-9c56a124be89",
        "value": "ericwbailey.website",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772821918",
        "to_ids": true,
        "type": "domain",
        "uuid": "79cbc5aa-b757-4004-ae2a-13fadaf8313d",
        "value": "eviewerpress.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772821940",
        "to_ids": true,
        "type": "domain",
        "uuid": "fcf8ab6c-541b-4471-a27c-330b2bef2f0d",
        "value": "leroibear.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772821962",
        "to_ids": true,
        "type": "domain",
        "uuid": "16643964-5aa8-40e9-9827-1530b5d65422",
        "value": "myshantispa.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772821984",
        "to_ids": true,
        "type": "domain",
        "uuid": "e831402a-5b68-4f4f-8263-64355e15070f",
        "value": "perceptivepumpkin.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772822005",
        "to_ids": true,
        "type": "domain",
        "uuid": "cc2af01d-b63d-4fd7-b735-e93bdc08d3a4",
        "value": "reviewerpress.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772822027",
        "to_ids": true,
        "type": "domain",
        "uuid": "3491feef-c784-4c8f-9edd-94172c2ff557",
        "value": "runners-daily-blog.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772822048",
        "to_ids": true,
        "type": "domain",
        "uuid": "f6139357-3549-478e-b3be-0ae0ca7e6eab",
        "value": "shiftypumpkin.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772822070",
        "to_ids": true,
        "type": "domain",
        "uuid": "6e628174-6a99-446a-a36b-7cbe38ecec9b",
        "value": "splintered.co.uk",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772822091",
        "to_ids": true,
        "type": "domain",
        "uuid": "2c47bd3b-7c8d-4178-87c4-9bc1ae7e0a8c",
        "value": "storage3d.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772822113",
        "to_ids": true,
        "type": "domain",
        "uuid": "cadf6648-424f-4827-8688-114aada1dde8",
        "value": "turnedninja.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772822135",
        "to_ids": true,
        "type": "hostname",
        "uuid": "b865c31a-3992-4497-a391-51529fa1baa2",
        "value": "reviewerpressus.mycartpanda.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772822156",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1cc466f5-4976-4860-9b56-36bc3e1ba2f4",
        "value": "token.llm7.io",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772822178",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1480365b-0f63-47e4-8180-9fea58267ebf",
        "value": "trinca.tornidor.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Websites and URLs containing IDPI",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772822201",
        "to_ids": true,
        "type": "hostname",
        "uuid": "8b99f515-6d6c-4c22-9254-2df2779c9dfd",
        "value": "cblanke2.pages.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Websites and URLs containing IDPI",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772822222",
        "to_ids": true,
        "type": "url",
        "uuid": "95280ea3-3c30-40e1-974f-d34baefefc37",
        "value": "ericwbailey.website/published/accessibility-preference-settings-information-architecture-and-internalized-ableism",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Websites and URLs containing IDPI",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772822244",
        "to_ids": true,
        "type": "url",
        "uuid": "19c4ee7f-888e-4ba4-a37e-8b16ef520b30",
        "value": "llm7-landing.pages.dev/_next/static/chunks/app/page-94a1a9b785a7305c.js",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Websites and URLs containing IDPI",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772822266",
        "to_ids": true,
        "type": "url",
        "uuid": "d6dbc315-44a7-45a2-8d55-b71492052ff1",
        "value": "reviewerpress.com/advertorial-maxvision-can/?lang=en",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772822288",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1ef6e36b-799a-4e89-bd7f-682923aea22d",
        "value": "splintered.co.uk",
        "Tag": [
          {
            "colour": "#669ae5",
            "local": false,
            "name": "AlreadyExistsError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Websites and URLs containing IDPI",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772822309",
        "to_ids": true,
        "type": "url",
        "uuid": "591cb77b-49b0-43e0-991e-1be79e1e43b4",
        "value": "storage3d.com/storage/2009.11",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Payment processing URLs used by websites containing IDPI",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772822331",
        "to_ids": true,
        "type": "url",
        "uuid": "f5584cf7-3d7d-4af4-9bc6-d094acfb8a25",
        "value": "buy.stripe.com/7sY4gsbMKdZwfx39Sq0oM00",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Payment processing URLs used by websites containing IDPI",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772822353",
        "to_ids": true,
        "type": "url",
        "uuid": "e7497458-ec68-4468-809f-9e62adac67e9",
        "value": "buy.stripe.com/9B600jaQo3QC4rU3beg7e02",
        "Tag": [
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Payment processing URLs used by websites containing IDPI",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772822376",
        "to_ids": true,
        "type": "url",
        "uuid": "876ea9a3-c944-4cf8-92d8-c5ded6499e58",
        "value": "paypal.me/shiftypumpkin",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}