Dark Sourcery: Poisoned Web Pages, 374 Brands, and Answers Nobody Checked

On 23 September 2026 the security firm Vigilance Security published research describing an active campaign it calls Dark Sourcery: attackers flood the open web with optimised posts, PDFs, reviews and fake support pages so that ChatGPT, Google Gemini and Google AI Overviews return fraudulent phone numbers, email addresses and login pages as a company's official contact details. Dark Reading reported the research the same day, naming Delta, Lufthansa, Qatar Airways, Chase, Bank of America, Airbnb and TripAdvisor among at least 374 companies caught up in it, with tens of thousands of malicious pages behind them. No model was broken into — the poisoned pages were simply what the models read, and the fraud arrived carrying the assistant's own credibility. This record is one entry in the OrcaRouter AI Incident Archive, which tracks AI incidents and research findings with the same fields used here: severity, confidence, disputed status and real harm.

What Vigilance Security actually published

The research is a Medium post by Ariel Simon, vice president of research at Vigilance, titled "Dark Sourcery: How Hackers Manipulate AI to Scam You," published on 23 September 2026. Dark Reading's account, by contributing writer Elizabeth Montalbano and time-stamped 14:47 UTC that day, links directly to it and quotes Simon throughout. The post describes a content operation rather than an exploit: no vulnerability is exploited, no credential is stolen by the attacker directly, and nothing is sent to a model that a model could learn to refuse.

Vigilance says it identified "tens of thousands of malicious pages" containing fake support numbers, email addresses, login pages, software-update information and other fraudulent details, built to shape what chatbots say. It puts the number of companies caught up at "at least 374," described as including Fortune 100 organisations, major airlines, banks, travel companies and software providers. The named brands in Dark Reading's report are Delta, Lufthansa, Qatar Airways, Chase, Bank of America, Airbnb and TripAdvisor.

Neither the research post nor the reporting that followed gives a per-brand breakdown — which fake number belonged to which company, how many poisoned pages were aimed at each, or when any individual page went up. The 374 figure is presented as a total, and the record carries it the same way.

Simon also cites a study by Exploding Topics, published in August 2026, finding that 91% of people using AI chatbots do not verify the answers provided. That number is the campaign's premise rather than its measurement: it is quoted in the research and repeated by Dark Reading and IANS, and its own methodology is not described in any of the coverage reviewed here. In Simon's framing, "if attackers control AI, and we blindly trust it, they essentially control us."

How the poisoning is built

The mechanism has three parts, and only the first one belongs to the attacker in any conventional sense. First, seed the web with pages that state the false contact detail. Second, make those pages look as though they come from somewhere a retrieval system should trust. Third, let the assistant do the citing.

The second step is where Vigilance puts most of its emphasis. "We suspect that high authority domains (universities, government) combined with public opinion sources (social media, forums, user reviews) achieved high success in poisoning AI answers," Simon told Dark Reading. "Depending on the model, the AI looks at the source and trusts the content more if it's coming from an authoritative entity." That is a description of borrowed reputation: a compromised or abused university page supplies the authority, and a scatter of forum posts and reviews supplies the appearance that the claim is corroborated elsewhere.

Ground Truth, an outlet that checks AI claims against their sources, summarised the seeding tactics listed in Simon's post: the same or similar false contact spread across user-generated posts, PDFs, hosted pages, reviews, fundraising and job platforms, and Q&A-style content; details tuned for retrieval with repeated formatting and phrases such as "24/7" and "updated 2026"; and the same phone number rendered with spaces, dots, emoji, Unicode lookalike characters or spelled-out words. That last technique does double duty — it defeats duplicate-string detection while a model still reads one number. Ground Truth describes the objective precisely: not one viral page, but "the appearance of independent corroboration."

GIGAZINE's write-up of the research offers one concrete illustration: a fabricated HP printer-support post and image carrying a phone number that was not HP's. It is an example of the pattern rather than an audited case, and the outlet attributes it to the Vigilance research rather than to an investigation of its own.

Not prompt injection — but filed that way

The distinction matters, and Simon draws it explicitly. Dark Reading quotes him saying the campaign differs from prompt injection "in that it doesn't involve the attacker giving AI explicit instructions or prompts, which might be thwarted by AI defenses." His sharper formulation: "Here, the disinformation displayed as facts is making the AI answer the user with the false information, without ever following any instruction/prompt by the attacker, essentially bypassing all defenses."

It also differs from training-data poisoning, which corrupts what a model learned before deployment. Everything here happens at retrieval time, against the live web, after the model has shipped — which is why no retraining fixes it and why the poisoned page can be taken down without the answer necessarily changing.

The archive files this record under IPI, its indirect-prompt-injection tag. Read carefully, the tag and the research are describing adjacent things: IPI covers content that reaches a model indirectly, inside material the model is asked to process, rather than being typed by its user. Dark Sourcery is that channel with the instruction removed — the payload is a fact, not a command. The tag is a filing decision about the channel; Simon's account is a claim about the payload, and the two are not in conflict. What the tag should not be read as is an assertion that an attacker prompt was delivered, because on the research's own account none was.

What the record establishes, and what it does not

The archive grades this record B — documented, but from a single or secondary source — and that grade is the most useful thing in it. Nothing in the coverage reviewed here contradicts the research. The problem is not contradiction; it is that the evidence chain is one document wide.

• Established: Vigilance Security published the research on 23 September 2026 under Simon's name, and it makes the claims described above — the 374 companies, the tens of thousands of pages, the named brands, the mechanism, the borrowed-authority tactic.

• Established: the research was reported the same day by Dark Reading, and within five days by IANS (24 September), GIGAZINE and Ground Truth (25 September), NEWSru.co.il citing the Israeli outlet Israel Defense (27 September), and the vendor research pages at Aviatrix (23 September) and Kronus Intelligence Group (28 September).

• Not established by that: independent verification. Each of those write-ups traces back to Simon's post or to Dark Reading's report of it, so they distribute the claims rather than test them. The archive's own second cited URL, bestsec.net, is a cybersecurity news digest that rolls over daily; on 26 October 2026 its front page carried no Dark Sourcery item, so the Dark Reading piece is the durable citation.

• Not established: the scale. Ground Truth states plainly that "the disclosure's claims of 374 affected companies and tens of thousands of pages have not been independently audited," and that no public dataset, corpus of malicious pages or reproducible query log was released. Kronus Intelligence Group's 28 September analysis reaches the same conclusion and proposes the useful label: describe the mechanism as established and the scale as "reported-but-unverified."

• Not established: reproducibility, by the researchers' own account. Ground Truth reports that Simon described the results as statistical and said they did not reproduce every time a query ran. That is an ordinary property of retrieval-augmented systems — rankings, model versions, location, timing and phrasing all move — and it is also the reason the finding could not be demonstrated on demand.

• Not established: the size of the harm. The archive records real harm as present, and the basis for that is narrow. Simon told Dark Reading that Vigilance had seen "a few occurrences" of people complaining about being scammed into giving up payment details or payment card data by fraudulent numbers provided in chatbot answers. The researchers also called some of the fake numbers themselves and reached a representative who offered to "move our flight" or "unlock our bank account," then asked for card details. No victim is named, no loss is quantified, and no complaint or enforcement action is cited.

• Not disputed: the archive records the entry as uncontested, and that holds up — the open questions in the coverage are omissions in the disclosure, not disagreements with it.

What the two platforms said

According to NEWSru.co.il, citing Israel Defense, the researchers reported the behaviour to both vendors. Google's reported position was that this kind of disinformation falls outside the scope of its vulnerability disclosure programme. OpenAI reportedly closed the report on the grounds that the findings could not be reproduced reliably, given the variability of language-model responses. Both summaries are paraphrases: the article names no spokesperson at either company, gives no direct quotation, and does not date the responses.

Neither response denies that the poisoned answers exist. Read as triage decisions rather than rebuttals, both are at least internally coherent — a bug bounty is built to reward a reproducible defect in code, and this is neither reproducible on demand nor a defect in code. The poisoned page is on someone else's website. What the exchange does demonstrate is a gap: the harm is real enough to produce victims and the behaviour is variable enough to fail a reproduction test, so it lands in the space between "security vulnerability" and "content problem," where no disclosure channel is waiting for it.

Neither OpenAI nor Google had publicly confirmed or rebutted the 374-company figure as of Kronus's 28 September analysis, and no statement from either company appears in any of the coverage reviewed here.

What changed afterwards

No platform change has been announced in response. The campaign was described as ongoing at publication on 23 September, and Simon's own assessment is that the accounting is unfinished: "We believe the real impact of these scams is happening now, and we are still unable to fully comprehend or measure the full impact yet."

What exists instead is advice. Simon's recommendations, as reported by Dark Reading, run in three directions. For users: verify what an assistant tells you rather than treating it as infallible. For brands: take customer complaints about scams seriously, monitor the AI answers customers actually receive and the sources those answers cite, and prioritise the categories where a wrong number is expensive — support, account recovery, refunds, payments and software downloads. For organisations running agents: monitor at runtime, verify every source and piece of content that enters the model's context, and check critical details — phone numbers, links, software packages, command lines — before acting on them. The comparison step he suggests is deliberately manual: "Compare returned phone numbers, email addresses, and URLs against verified company records, then investigate unfamiliar details and repeated indicators across unrelated websites."

IANS put the same advice through its faculty review, with Josh More placing the campaign in a lineage — "We've seen this on search engines for years" — and George Gerchow compressing the mechanism into a line worth keeping: "Nobody broke into the model. They seeded the sources it trusts and let it do the talking. The chatbot didn't get hacked; it got fed." IANS's faculty recommendations add brand monitoring and limits on agent autonomy to the verification advice, and none of them constitute a fix.

Why the record is worth keeping

Search-result poisoning is old. What this record describes is the point at which the search result stopped being the thing the user sees. In the conventional version, a victim lands on a page, and the page is the evidence — badly spelled, oddly hosted, visibly not the bank. Here the page is never rendered. A model reads it, agrees with it, and writes a sentence that begins with the brand's name and ends with the attacker's number. The citation may be there, but the judgement that a citation normally supports has already been made by something that does not get tired or suspicious.

That is also why the record's confidence grade is doing real work rather than housekeeping. The mechanism is not in serious doubt — it is how retrieval-augmented systems are built, and the industry analysts who wrote about it treated it as plausible on sight. The scale is in doubt, and will stay in doubt until someone releases a corpus or a query log. A single firm's measurement, distributed by outlets that all cite the same post, is a reason to record the incident and a reason not to repeat the number as though it had been counted twice.

The archive's own framing puts it at high severity with AI involvement confirmed, real harm recorded and no dispute attached. What the entry really documents is a transfer of trust: the brand's reputation is the raw material, the assistant's fluency is the delivery mechanism, and the verification step that would have caught it is the one 91% of users are said to skip.