LoginTrap Coaxes Web Agents into Phishing Logins

Problem

This paper studies whether untrusted webpage content can coerce LLM-based web agents to initiate login flows and thereby leak sensitive information. Login is identified as a common, security-sensitive boundary because it handles credentials and account data, yet many user tasks do not inherently require authentication. Prior prompt-injection work showed agents can be manipulated, but did not fully explore whether page-level content alone can induce a login as a plausible intermediate step and cause end-to-end credential or private-data leakage.

Approach

The authors design LoginTrap, a task-agnostic, black-box attack in which the adversary controls only the webpage observation and the subsequent login flow. The attacker clones real webpages, inserts a controlled popup containing a page-specific login-inducing statement and a forged login entry, and hosts an attacker-controlled login page that requests sensitive fields. Page-specific injection text is generated by a fuzzing-inspired pipeline that uses an LLM to extract page summaries, propose candidate statements, evaluate candidates with shadow LLMs, and mutate failed candidates. Evaluation uses a controlled local environment with 80 cloned webpages and 1,175 task instances drawn from a real-world benchmark. Metrics are Login Entry Rate (LER), Attack Success Rate (ASR, end-to-end leakage), and Page Exploitability Rate (PER). The generation pipeline used GPT-4o; evaluated web agents used different LLM backbones and three representative agent architectures. Each run used a fixed interaction step budget and action-based labelling of clicks and form inputs.

Key Findings

• High induction and leakage: Across LLM backbones LoginTrap achieved an average Login Entry Rate of 93% and an average end-to-end Attack Success Rate of 86%, indicating that agents frequently click the forged login and often proceed to submit sensitive data.
• Broad transferability: The attack generalises across agent architectures. In architecture experiments (Browser-Use, LiteWebAgent, Skyvern) LER ranged roughly 84% to 94% and ASR ranged roughly 68% to 89%, with an overall reported average attack success of about 79% across architectures.
• Page-level exploitability: Every tested webpage was exploitable within the evaluation budget, so PER reached 100% across backbones; however, the number of attempts to first success varied by model and domain, with some models succeeding on the first attempt and others requiring more tries.
• Variation by model and domain: Some models (Gemini 3 Flash, Claude Sonnet 4) more reliably convert login entry into form completion; GPT-4o and DeepSeek showed larger gaps between LER and ASR, often due to interruptions after navigation. Domains with account-related cues, such as Shopping and Travel, made the induced login easier to reconcile with task progress.

Limitations

The evaluation used cloned webpages and a local controlled login flow, a fixed interaction step budget, and action-based labelling rather than internal model traces. The attacker model is conservative in that it cannot modify the agent runtime or observe internals, but the injection generator itself used an LLM. Results therefore reflect a reproducible, laboratory-style threat model and may vary in wild deployments.

Implications

Offensively, an adversary who can control webpage content can craft task-agnostic injections that make login appear necessary, route agents to attacker-hosted login pages, and harvest credentials or other background data at scale. The vulnerability spans multiple LLM backbones and agent architectures, so attackers need not rely on knowledge of the user task or agent internals. This elevates login inducement into a practical phishing-style vector against delegated automation.