Needle Stealer Campaign Uses Fake TradingClaw Site to Target Browsers

Apr 22, 2026 · Original article ↗

Summary

Researchers detail a campaign distributing the Golang infostealer Needle through a fake TradingClaw site. The malware uses DLL hijacking and process hollowing, steals sensitive data, and can install browser extensions that monitor and manipulate browsing.

Key points

A fake TradingClaw site (tradingclaw[.]pro) lures visitors into downloading a ZIP file containing the first stage of the infection.
The iviewers.dll loader loads a second-stage DLL, which injects Needle Stealer into RegAsm.exe using process hollowing.
Needle can collect browser data, screenshots, files, Telegram and FTP client data, and cryptocurrency wallet information.
The malware can install browser extensions that track browsing, redirect users, inject scripts, display fake notifications, and replace downloads.
The extensions communicate with C2 servers through API endpoints for stolen data, instructions, and malicious scripts, with backup domains available.
The article advises checking EDR and firewall logs, reviewing browser extensions, and securing accounts and cryptocurrency wallets from a clean device if affected.

Article Details

Attack Vectors: A fake TradingClaw website (tradingclaw[.]pro) lures visitors into downloading a ZIP containing the first stage of the infection.
The loader uses DLL hijacking via iviewers.dll to load a second-stage DLL, which injects Needle Stealer into RegAsm.exe using process hollowing.
Needle Stealer can install malicious browser extensions that collect browsing history, inject scripts, redirect traffic, intercept downloads, and display fake notifications.
Defensive Notes: Download software only from official websites and verify the publisher before running downloaded files.
Review browser extensions regularly and remove extensions that are unfamiliar or were not knowingly installed.
For suspected infections, check EDR and firewall logs for the listed C2 indicators and inspect %LOCALAPPDATA%PackagesExtensions for suspicious extensions.
From a clean device, sign out of active account sessions, change passwords, enable 2FA, and move cryptocurrency funds from affected machines.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`chrocustomreversal[.]com`	Domain identified as related to the malicious browser extension.
DOMAIN	`chrocustumapp[.]com`	Domain identified as related to the malicious browser extension.
DOMAIN	`coretest[.]digital`	C2 panel domain listed in the article's IOCs.
DOMAIN	`google-services[.]cc`	Domain identified as related to the malicious browser extension.
DOMAIN	`reisen[.]work`	C2 panel domain listed in the article's IOCs.
DOMAIN	`tradingclaw[.]pro`	Fake TradingClaw website used as the malware-distribution lure.
IPV4	`162[.]216[.]5[.]130`	IP address identified as a C2 panel.
IPV4	`178[.]16[.]54[.]109`	IP address identified as a C2 panel.
IPV4	`178[.]16[.]55[.]234`	IP address identified as a C2 panel.
IPV4	`185[.]11[.]61[.]149`	IP address identified as a C2 panel.
IPV4	`2[.]56[.]179[.]16`	IP address identified as a C2 panel.
IPV4	`209[.]17[.]118[.]17`	IP address identified as a C2 panel.
IPV4	`37[.]221[.]66[.]27`	IP address identified as a C2 panel.
SHA256	`0d10a6472facabf7d7a8cfd2492fc990b890754c3d90888ef9fe5b2d2cca41c0`	Needle-related binary hash listed in the article's IOCs.
SHA256	`95dcac62fc15e99d112d812f7687292e34de0e8e0a39e4f12082f726fa1b50ed`	Needle-related binary hash listed in the article's IOCs.