Fake AI trading agent steals crypto wallet passwords

Attackers built a website for a fake AI crypto trading agent and used it to install Needle Stealer, malware that replaces a victim’s browser wallet with a copy that sends the wallet password to the attacker. HP caught the campaign between April and June 2026.

The Needle campaign targets people who download AI agents from search results or ads, and users of seven browser wallet extensions, among them MetaMask, Coinbase Wallet and Phantom. HP also caught QR code phishing that moves victims onto their phones.

Example of a website promising an installer for an AI trading agent (Source: HP)

The installer is genuine Microsoft software

The site, tradingclaw[.]pro, gave its bot a name that echoes a well-known AI assistant and promised an agent that trades crypto around the clock. Inside the ZIP download, Trading Agent.exe is OLEView, a Microsoft-signed program, so Windows SmartScreen’s reputation check trusts it. Its only purpose is to get past that check. When it runs, it loads iviewers.dll, the malicious file beside it, a trick called DLL side-loading.

That DLL runs Needle Stealer inside a freshly started legitimate process, a technique called process hollowing. Needle looks for any of the seven wallet extensions, kills the browser, and unpacks a malicious copy into the extension’s folder. The fake extension then contacts the attacker’s command server and hands over whatever password the victim types. With the wallet ID and password, the attacker controls the funds.

If you keep a crypto wallet in your browser, a familiar unlock screen does not prove the extension is the one you installed. HP recommends keeping wallet passwords and payment work out of agent apps you cannot verify.

The QR code moves the victim to a phone

Researchers also caught several campaigns that emailed PDF invoices showing a blurred document behind a QR code, with a note telling the recipient to scan it with a smartphone, a method known as quishing. The scan runs through redirects, including a fake email security scanner and a Cloudflare Turnstile check that confirms a person is loading the page, then lands on a page resembling OneDrive that asks for Microsoft credentials.

A work PC may have email gateways and browser protections that already block a known phishing domain. A phone usually carries fewer defenses, so a link the desktop would stop may load on the phone.

A stealer sold with customer support

Phantom Stealer is sold openly on the web as a “penetration testing tool,” alongside a crypter that encrypts it against analysis, feature updates and 24/7 support. Buyers must agree not to use it for malicious purposes. HP isolated several email campaigns delivering it.

A VBScript in each campaign built a PowerShell command that fetched an ordinary-looking image and pulled a .NET loader out of it, a method called steganography. A component named Phantom Gate, built into the PowerShell script, started that loader. The loader then downloaded the stealer, decoded it and injected it into RegAsm, a legitimate .NET Framework process. Researchers believe the shared name and delivery chain suggest one threat actor may be behind both tools.

“Users move constantly between devices and applications, like browsers or new AI tools, and attackers are quick to follow. Security needs to work across all of those interactions, without getting in people’s way. That means organizations need a zero-trust approach built around isolation and containment, so untrusted clicks and downloads don’t become a risk,” said James Wright, HP’s Global Head of Security for Personal Systems.

Hundreds of rigged images

Other invoice campaigns arrived two ways. Some used HTML smuggling, which assembles the malicious file on the victim’s machine so it can slip past email gateway scanners. Others relied on search results leading to lookalike domains. Both routes ended with loaders that decoded payloads hidden in images and installed XWorm, PureLogs Stealer or Formbook, which steal credentials and system data.

A perceptual-hash search of VirusTotal, which matches images by how they look, turned up about 400 distinct images tied to these campaigns over three months.

Fake installers

HP’s researchers also traced a Russian-language imitation of Microsoft’s site whose installer bundles other products for affiliate payouts and never installs Word. The security product it bundles then flags that installer as dangerous and deletes it. Two signed installers, UltraZip and AllFiles, hijack the default search engine and keep the change after uninstall.

Download: 2026 Credential Risk Report