debank.auction
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·4uZHKv…etu6Summary
debank[.]auction is a malicious domain impersonating DeBank (debank.com), a legitimate decentralized finance portfolio tracker founded in 2018. Documented by Zscaler ThreatLabz in July 2026, the site combines typosquatting with indirect prompt injection (IPI) — embedding hidden instructions in its HTML to manipulate AI agents into misclassifying the fraudulent domain as the authoritative DeBank platform. The campaign represents an active, real-world exploitation of autonomous AI agents rather than solely targeting human users.
Connected Entities
1 entities · 10 linked investigationsTimeline(6 events)
2018
DeBank (debank.com), the legitimate DeFi portfolio tracker being impersonated, launches. Exact founding date is approximate; commonly cited as 2018.
DeBank Review 2026 — CryptoAdventureMay 2026
The Hacker News publishes analysis arguing that typosquatting has evolved from a user-facing risk to an AI supply chain threat, establishing the broader context for campaigns like debank.auction.
Typosquatting Is No Longer a User Problem — The Hacker News2 July 2026
Zscaler ThreatLabz publishes research documenting debank[.]auction as an active indirect prompt injection campaign targeting AI agents, alongside a companion Python-library impersonation campaign.
Indirect Prompt Injection Targets AI Agents — Zscaler ThreatLabz6 July 2026
SecurityWeek reports on the Zscaler findings, noting that four of 26 LLMs executed fraudulent crypto payments in testing and that GPT-5.4 and Claude Sonnet 4.5 misclassified the DeBank typosquatting domain as legitimate when lacking a reference source.
Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments — SecurityWeek9 July 2026
Broader security press coverage of the campaign continues, with Infosecurity Magazine and other outlets amplifying the Zscaler findings.
Indirect Prompt Injection in Web Content Targets AI Agents — Infosecurity Magazine5 August 2026
Zscaler ThreatLabz updates its original blog post on the indirect prompt injection campaigns. No confirmed takedown of debank[.]auction is noted in available sources as of this date.
Indirect Prompt Injection Targets AI Agents — Zscaler ThreatLabzDecision Log
- hash: 5goxQQq73kVPzUGjNJAxpWhKbc2p6DW49MoVhv68mYRs
- hash: FWrCSZiwohQDeMfvR13XQTM1UPbfUwBxuJZEQ7okG8qf
- hash: 3oizbdTn7djY245HV4w3jFiwaLVWLGPKDS2bw3LF8xpH
This investigation is cryptographically anchored to the Solana blockchain (3 events). 10 of 10 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/15/2026, 5:12:40 PM
last updated: 8/25/2026, 1:41:22 PM
3 viewsavoid.net — verified advice for a post-truth world