Fake AI Trading Agent Delivers Needle Stealer to Replace Crypto Wallet Extensions
Summary
HP traced a fake AI trading agent delivering Needle Stealer, which replaced browser wallet extensions to steal passwords. It also reported QR-code phishing and other campaigns using image-based payloads, loaders and fake installers.
Key points
- HP observed the Needle Stealer campaign between April and June 2026, using a fake AI crypto trading agent site, tradingclaw[.]pro, to lure downloads.
- The downloaded installer used a Microsoft-signed program to load a malicious DLL, which ran Needle Stealer through process hollowing.
- Needle Stealer replaced supported browser wallet extensions with malicious copies that sent entered passwords to an attacker command server; targeted wallets included MetaMask, Coinbase Wallet and Phantom.
- HP also found QR-code phishing that redirected people from invoice PDFs to a OneDrive-like page requesting Microsoft credentials.
- Phantom Stealer campaigns used VBScript, PowerShell and image-hidden payloads to load and inject the stealer; HP researchers said shared naming and delivery methods may indicate a common actor.
- Other invoice campaigns used HTML smuggling or lookalike domains to deliver XWorm, PureLogs Stealer or Formbook; image searches identified about 400 campaign-related images over three months.
- HP advised users not to entrust wallet passwords or payment activity to AI agent apps they cannot verify.
Article Details
- Attack Vectors
- A fake AI crypto-trading-agent website distributed a ZIP containing a Microsoft-signed executable that side-loaded a malicious DLL. The DLL used process hollowing to run Needle Stealer.
- Needle Stealer searched for browser wallet extensions, replaced them with malicious copies, and sent entered wallet passwords to an attacker command server.
- QR-code phishing in emailed PDF invoices redirected recipients to a page resembling OneDrive that requested Microsoft credentials.
- VBScript-built PowerShell commands fetched image files containing a hidden .NET loader; the loader downloaded and decoded Phantom Stealer, then injected it into RegAsm.
- Other invoice campaigns used HTML smuggling or lookalike domains to deliver loaders that extracted payloads from images and installed XWorm, PureLogs Stealer, or Formbook.
- Defensive Notes
- HP recommends not using wallet passwords or handling payment activity through agent apps that cannot be verified.
- A familiar wallet unlock screen does not establish that the browser extension is the one originally installed.
- HP recommends a zero-trust approach built around isolation and containment to reduce risks from untrusted clicks and downloads.
- QR-code links should be treated cautiously, especially when they move a user from a protected desktop to a phone with fewer defenses.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | tradingclaw[.]pro | Domain of the fake AI trading-agent website used to distribute Needle Stealer. |
MITRE ATT&CK
T1027.003 · SteganographyLoaders were extracted from downloaded images, and other payloads were hidden in images using steganography.T1027.006 · HTML SmugglingSome invoice campaigns used HTML smuggling to assemble a malicious file on the victim’s machine.T1055 · Process InjectionThe Phantom Stealer loader injected the decoded stealer into RegAsm.T1055.012 · Process HollowingThe article says the DLL ran Needle Stealer inside a freshly started legitimate process using process hollowing.T1059.001 · PowerShellA VBScript-built PowerShell command fetched an image and extracted a .NET loader.T1105 · Ingress Tool TransferThe PowerShell command fetched an image, and the .NET loader downloaded the stealer.T1566.001 · Spearphishing AttachmentEmail campaigns delivered PDF invoices containing QR codes that directed recipients to phishing pages.T1574.002 · DLL Side-LoadingThe fake installer loaded the malicious iviewers.dll placed beside it.
People
Malware
FormBook#NeedleStealerNeedle StealerHP identified a fake AI crypto trading agent website that delivered Needle Stealer, which swaps browser wallet extensions to steal passwords and give attackers control of funds.PhantomStealerThe company also tracked QR code phishing, Phantom Stealer, and other fake installer campaigns that used image-based payloads, DLL side-loading, and process injection to spread theft tools.PureLogs StealerBoth routes ended with loaders that decoded payloads hidden in images and installed XWorm, PureLogs Stealer or Formbook, which steal credentials and system data.XWorm#NeedleStealer
Products
Coinbase WalletThe campaign targeted users of MetaMask, Coinbase Wallet, Phantom, and other wallet extensions.MetaMask#NeedleStealerMicrosoft OneDrive#NeedleStealerMicrosoft WindowsInside the ZIP download, Trading Agent.exe is OLEView, a Microsoft-signed program, so Windows SmartScreen’s reputation check trusts it.PhantomThe company also tracked QR code phishing, Phantom Stealer, and other fake installer campaigns that used image-based payloads, DLL side-loading, and process injection to spread theft tools.