{
 "tag": "typosquat",
 "name": "Typosquat",
 "group": "Other",
 "incidents": [
  {
   "slug": "zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026",
   "title": "Zscaler: live web campaigns hide prompt injections telling browsing AI agents to make crypto payments",
   "url": "https://drains.watch/i/zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026",
   "json": "https://drains.watch/i/zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026.json",
   "status": "closed",
   "severity": "low",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The pages carry hidden instructions written for AI agents, telling them to make crypto payments or to trust a fake DeBank site."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "agent-hijack",
   "product": "AI agents that browse the web and can pay",
   "tags": [
    "multi-evm",
    "agent-hijack",
    "prompt-injection",
    "ai-agent",
    "agent-payments",
    "seo-poisoning",
    "typosquat",
    "debank",
    "zscaler",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-07-06",
   "closedAt": "2026-07-06",
   "updatedAt": "2026-07-06T12:00:00Z",
   "summary": "SecurityWeek reported on 6 July 2026 that Zscaler found two campaigns in use that plant hidden instructions on web pages for AI agents that can browse and pay. One used SEO poisoning to lure agents searching for a fake Python package, requests-secure-v2, backed by 10 GitHub repositories; the other typosquatted the DeFi portfolio tracker DeBank. In Zscaler's own tests 4 of 26 models were manipulated into making a payment and 2 mistook the fake DeBank site for the real one. No real losses were reported, but agents with spending power should only pay allow-listed recipients."
  },
  {
   "slug": "npm-galedonovan-solana-key-stealers-mar-2026",
   "title": "Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys",
   "url": "https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026",
   "json": "https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "solana",
    "ethereum"
   ],
   "method": "supply-chain",
   "product": "npm packages raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet, base_xd",
   "tags": [
    "solana",
    "ethereum",
    "supply-chain",
    "npm",
    "typosquat",
    "bs58",
    "base58",
    "telegram-c2",
    "developers",
    "raydium"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-03-26",
   "closedAt": "2026-03-26",
   "updatedAt": "2026-03-26T12:00:00Z",
   "summary": "In March 2026, Cyber Press reported five malicious npm packages from the account 'galedonovan', aimed at crypto developers: raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet and base_xd. The Solana packages intercept Base58 decode() calls used to load keypairs and send the private key in plain text to a Telegram bot, while the app keeps working normally. The Ethereum package hooks the Wallet constructor. base_xd was pulled within five minutes, but the other four were still live when the report came out. Developers who installed any of them should rotate keys and move funds."
  }
 ],
 "changes": [
  {
   "incident": "zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026",
   "incidentTitle": "Zscaler: live web campaigns hide prompt injections telling browsing AI agents to make crypto payments",
   "severity": "low",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-06",
   "title": "SecurityWeek reported Zscaler's findings on two campaigns using hidden web instructions to push AI agents into crypto payments.",
   "sourceUrl": "https://www.securityweek.com/prompt-injection-attacks-trick-ai-agents-into-making-crypto-payments/",
   "url": "https://drains.watch/i/zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026"
  },
  {
   "incident": "npm-galedonovan-solana-key-stealers-mar-2026",
   "incidentTitle": "Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-26",
   "title": "Cyber Press reported five 'galedonovan' npm packages that exfiltrate Solana and Ethereum private keys to a Telegram bot; four were still live.",
   "sourceUrl": "https://cyberpress.org/telegram-attack-targets-crypto-developers/",
   "url": "https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026"
  }
 ]
}