Fake AI trading agent steals crypto wallet passwords
Fake AI crypto trading agent sites deliver Needle Stealer, which replaces browser wallet extensions to steal wallet passwords, HP reports.
HP researchers tracked campaigns between April and June 2026 in which a fake AI trading agent site, tradingclaw[.]pro, distributed a Microsoft-signed OLEView executable that DLL side-loads a malicious iviewers.dll and launches Needle Stealer via process hollowing. Needle replaces one of seven browser wallet extensions, including MetaMask, Coinbase Wallet, and Phantom, to capture wallet passwords. Related campaigns used QR-code invoice phishing leading to fake OneDrive pages, Phantom Stealer sold as a penetration testing tool with VBScript-to-PowerShell steganographic loaders, and image-hidden payloads delivering XWorm, PureLogs Stealer, and Formbook; a perceptual-hash VirusTotal search found about 400 distinct rigged images.
- tradingclaw[.]pro site distributes ZIP containing Microsoft-signed OLEView side-loading loader
- Needle Stealer swaps seven browser wallet extensions to capture wallet passwords
- QR-code invoice phishing pushes victims to phones ending at fake OneDrive login
- Phantom Stealer sold openly with crypter, updates, and 24/7 support
- Perceptual-hash VirusTotal search tied roughly 400 images to campaigns over three months
- ATT&CK
- T1566.002 Spearphishing LinkT1204.002 Malicious FileT1574.002 DLL Side-LoadingT1055.012 Process HollowingT1027.003 Steganography
- Tags
- crypto-walletdll-side-loadinginfostealerneedle-stealerphantom-stealerprocess-hollowingquishingxworm
- Products
- MetaMaskCoinbase WalletPhantom
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | tradingclaw.pro | : HP) The installer is genuine Microsoft software The site, tradingclaw[.]pro, gave its bot a name that echoes a well-known AI assistan |
From the original article
3 min read at helpnetsecurity.com
Attackers built a website for a fake AI crypto trading agent and used it to install Needle Stealer, malware that replaces a victim’s browser wallet with a copy that sends the wallet password to the attacker. HP caught the campaign between April and June 2026.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.