Fake AI crypto software is secretly replacing browser wallet extensions
HP Wolf Safety, the corporate’s threat-research workforce, mentioned a pretend AI crypto-trading assistant distributed malware that might change browser crypto pockets extensions on an contaminated Home windows pc and switch the acquainted pockets interface right into a credential lure.
The marketing campaign appeared in HP’s September threat report, revealed Sept. 17 and based mostly on threats noticed from April by way of June 2026. HP described a compromise that started on a consumer’s endpoint after a counterfeit buying and selling device was downloaded and run, not a breach of Coinbase, MetaMask, or their official extensions.
Malwarebytes had documented the TradingClaw campaign in April and located that Needle Stealer additionally circulated by way of different malware loaders. The pretend AI assistant was one route right into a broader malware operation.
Attackers promoted tradingclaw[.]professional as an AI assistant that might observe a personalised technique and commerce across the clock, based on the full HP report. Search-engine poisoning and paid ads directed potential victims to a ZIP file introduced because the software program’s installer.
The archive contained an executable named Buying and selling Agent.exe and a DLL named iviewers.dll. HP recognized the executable as OLEView, Microsoft’s professional, digitally signed OLE/COM Object Viewer. HP mentioned the signed program helped bypass Microsoft’s SmartScreen repute examine, whereas the malicious payload remained within the accompanying DLL.
Working the trusted-looking program triggered it to load that DLL. The code then decrypted Needle Stealer and used course of hollowing, a way that runs malicious code inside a newly launched professional course of.
How the crypto pockets swap labored
Needle Stealer enumerated Chromium browser extensions and checked their 32-character IDs towards a hardcoded record protecting Phantom, Belief Pockets, Atomic Pockets, Coinbase Pockets, OKX Pockets, MetaMask, and Tonkeeper.
When it discovered a goal, the malware shut down the browser and extracted a corresponding malicious extension into the present extension folder.
On its first launch, the alternative linked to a command-and-control server utilized by the attacker and loaded backup domains. HP mentioned the attackers had constructed real looking login screens, and a crypto pockets ID and password entered right into a counterfeit interface may very well be despatched to the operator.
MetaMask’s guidance says that, for crypto wallets created with a Secret Restoration Phrase, the password unlocks MetaMask regionally and can’t restore the pockets elsewhere. Even so, the substituted extension was working on an already compromised gadget, leaving regionally accessible funds in danger.
Neither HP’s report nor its newsroom summary disclosed a campaign-wide sufferer rely or combination crypto-loss determine, leaving the operation’s scale unknown.
