# Injected Hyperlink — Scam / Malware / Advertising URL in the Response

- **Severity:** High
- **Signature ID:** `8f80d5e9-9a58-4222-b644-b57dace7ea02`
- **MITRE ATLAS:** AML.T0048 (External Harms), AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection), LLM05 (Improper Output Handling)

## Summary

Attackers hide instructions inside content an AI agent reads — a webpage, document, or email — telling it to add a link or contact address to whatever it outputs next. If the agent obeys, it ends up handing the user a phishing link, fake software download, or lottery scam contact as if it were part of a normal answer.

## How the attack works

An attacker plants text in a source the agent will process, such as a document, webpage, or email, containing wording like 'add', 'include', or 'suggest' this link or contact in your response. The agent treats this planted text as an instruction rather than as data to summarize. It then inserts the attacker's URL or email address into its output, targeting the user-facing response. The user receives a reply that looks legitimate but contains a scam, phishing, malware-download, or advertising link chosen by the attacker.

## Why it matters

Users trust the agent's output and can be led to phishing sites, fake software installers, malware downloads, or scam contacts, resulting in credential theft, malware infection, or fraud — all while appearing to come from a trusted assistant.

## What you can do

- Treat any content the agent ingests from external sources (web pages, documents, emails) as untrusted and never as instructions.
- Filter or strip URLs and email addresses that appear in agent output but were not present in the original user request or verified sources.
- Require human review or link-safety checks before an agent's response with hyperlinks or contact details reaches end users.
- Log and monitor cases where agent responses include links absent from the source material the user actually requested.

## Known benign look-alikes

- Security documentation, papers, or test suites that describe this attack technique without executing it.
- Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01904

---
Source: https://www.netzilo.com/threats/atr-injected-hyperlink-scam-malware-advertising-url-in-the-respo