Fake AI Trading Agents Replace MetaMask and Coinbase Wallet Extensions With Malware

What is the fake AI trading agent malware campaign?

Fake AI trading agent malware is a phishing campaign that promotes an always-on cryptocurrency trading assistant and installs Needle Stealer on a victim’s device. HP Wolf Security disclosed the activity on September 17, 2026, based on threat telemetry from consenting customers collected during April through June 2026. HP Wolf Security’s September 2026 Threat Insights Report identifies the campaign as part of a wider set of threats that use familiar services and AI branding to encourage unsafe downloads.

The fake site impersonates an AI-powered crypto trading tool and uses the name of a well-known AI product to look more credible. The central risk is not merely a misleading investment claim. The download is designed to gain access to browser-based crypto wallets and collect passwords from users who believe they are signing in to a legitimate extension.

Fake AI trading agent malware deserves particular caution because browser extensions often sit close to financial accounts and wallet recovery workflows. A polished trading dashboard or AI assistant label does not establish that a download is legitimate. The practical response is to obtain wallet software and extensions only through the wallet provider’s official website or the browser’s recognized extension store.

How does Needle Stealer replace crypto-wallet extensions?

Needle Stealer scans a victim’s browser for installed wallet extensions, then replaces selected extensions with malicious lookalikes. HP Wolf Security said the malware searched for Coinbase Wallet and MetaMask, among other targets, before harvesting passwords entered into the fraudulent extension. The theft occurs when a victim sees what appears to be a normal wallet prompt and types credentials into the attacker-controlled copy.

The campaign’s targeted wallet extensions included 7 products: Phantom, Trust Wallet, Atomic Wallet, Coinbase Wallet, OKX Wallet, MetaMask, and Tonkeeper. The affected set matters because users can have more than one wallet extension installed, and a fake AI trading application can present itself as a tool intended to work across multiple wallets. The identified wallet-extension list shows that the campaign focused on widely used browser wallet categories rather than a single provider.

Browser-extension malware can be difficult to recognize from appearance alone because the attacker benefits when the fake prompt resembles a wallet interface the victim already knows. The most sensible approach is to treat an unexpected password request from a wallet extension as a warning sign, particularly after installing a trading-related application.

Why did the fake installer evade SmartScreen reputation checks?

The fake installer used a legitimate Microsoft-signed program named OLEView alongside a malicious DLL named iviewers.dll. The ZIP package presented the executable as “Trading Agent.exe,” while the campaign used DLL sideloading and process hollowing to run Needle Stealer. Those techniques matter because the visible executable can appear more trustworthy when a legitimate signed program is involved.

HP’s findings indicate that the attackers used the signed binary to evade SmartScreen reputation checks before loading the malicious component. SmartScreen reputation signals can help identify unfamiliar downloads, but a signed file is not proof that every file packaged with it is safe. The malicious DLL is the important concern in this case, because the legitimate program can be used as a vehicle for the attacker-controlled code.

Windows users should not treat a familiar publisher prompt or a signed executable as a complete security review of a ZIP archive. The same principle applies to software promoted as a shortcut for online work, shopping, or investing, especially when the download arrives through a link rather than an official product page. A recent supply-chain malware incident illustrates why trusted-looking delivery paths still require verification.

Stop and contact the wallet provider or a qualified security professional if a suspected installer has already been run and wallet access is involved. Deleting a visible file does not establish that malware activity has stopped, and users should avoid entering any more wallet passwords on the affected device until they have received appropriate support.

Which wallet users face the greatest risk?

Wallet users who installed the advertised trading assistant or entered a password after seeing a changed extension prompt face the clearest risk from this campaign. HP Wolf Security observed the malware scanning for 7 specific extensions, including MetaMask, Coinbase Wallet, Phantom, Trust Wallet, Atomic Wallet, OKX Wallet, and Tonkeeper. A user does not need to use every listed extension for the attack to matter, because the malware searches for the wallets present in that browser.

Users who rely on browser extensions for frequent cryptocurrency activity should also pay attention to unexpected extension changes. A wallet extension that suddenly requests a password, displays a different interface, or appears after a suspicious application install deserves immediate verification through the browser’s extension-management controls and the wallet provider’s official support materials.

Crypto-wallet scams increasingly use familiar digital services to create urgency or confidence. Users who have seen phishing prompts through messaging, ads, or browser pop-ups may also benefit from reviewing mobile scam warning tools, although a keyboard warning cannot validate a downloaded desktop application. The limitation is important: device-level warnings can reduce some risky actions, but they do not replace checking the software source.

How do QR-code phishing PDFs expand the threat?

QR-code phishing PDFs expand the threat by moving victims from a protected work computer to a less-protected phone before sending them to credential-stealing pages. HP Wolf Security said the documents use QR codes to shift the interaction away from a corporate device, where security controls may be stronger, and onto a personal mobile device where the victim may be less cautious.

The QR-code technique is relevant to fake AI trading agent malware because the scam does not need to remain on one device. A victim can encounter a document at work, scan the code with a phone, and then reach a login page or download prompt outside the original computer’s security environment. The practical response is to avoid scanning unexpected QR codes in PDFs, email attachments, or shared documents that request account access.

Users should verify a destination independently instead of relying on the page that appears after scanning. Open the relevant wallet provider’s official site directly if a QR code claims that an account needs attention. A QR code is only a link encoded as an image, and its appearance does not confirm that the destination is legitimate.

How can users avoid fake AI trading assistant downloads?

Users can avoid fake AI trading assistant downloads by verifying the developer, the download location, and the wallet connection request before installing software. This campaign relied on a phishing site and a ZIP package, so the first protection is refusing to run software promoted through an unsolicited message, ad, unfamiliar social post, or unexpected web page. A trading claim or AI label does not make the installer trustworthy.

1. Open the wallet provider’s official website directly before downloading an extension or support tool.
2. Check the browser’s extension-management page for unfamiliar wallet extensions or duplicate-looking entries.
3. Delete suspicious ZIP archives rather than opening an executable labeled as a trading agent.
4. Pause before entering a wallet password if an extension prompt looks different after a software installation.
5. Contact the wallet provider through its official support channel if a wallet extension appears to have changed.

Users should also keep work documents and investment activity separate when possible. The QR-code phishing activity documented by HP shows that attackers can use a protected work environment only as a starting point, then move the victim toward a personal phone. This matters because security decisions still depend on the person following the link, not only on the device that first displayed it.

Stop before attempting advanced malware removal if the suspected device contains active wallet access or valuable account data. A wallet provider can explain its account-security process, while a qualified security professional can assess the affected device without treating a potentially serious credential-theft incident as a routine software cleanup.

What should you do if you installed the fake trading agent?

Users who installed the fake trading agent should stop entering wallet passwords on the affected device and contact the relevant wallet provider through its official support channel. HP Wolf Security said Needle Stealer can replace wallet extensions with malicious lookalikes and harvest passwords entered into those copies. Continued use can expose additional credentials if the fraudulent extension remains active.

Users should document what was downloaded, when it was installed, and which wallet extensions were present before making changes. That record can help the wallet provider or security professional understand the situation. Users should also avoid relying on links, phone numbers, or support prompts displayed by the suspicious application, because attackers can use those details to extend the fraud.

HP also observed related Phantom Stealer campaigns delivered by email, where a PowerShell script extracted a loader from an image and used Phantom Gate to inject malware into RegAsm. Technical reporting on the related delivery activity shows that the broader threat environment includes more than one lure and execution method. The practical lesson is to treat an unexpected script, attachment, or software installer as part of the same possible risk chain.

Users should stop and seek professional help if the device contains financial accounts, work credentials, or a wallet that has already received a password prompt after the suspicious installation. A normal user can identify an unexpected download and stop using it, but malware analysis and account-recovery decisions require support from the wallet provider or a qualified security professional.

FAQ

Is the fake AI trading agent a legitimate crypto tool?

The fake AI trading agent is not a legitimate crypto tool. HP Wolf Security identified the phishing site as a lure for Needle Stealer malware, which searches for targeted browser wallet extensions and collects passwords entered into malicious lookalikes.

Which crypto wallets did Needle Stealer target?

Needle Stealer targeted 7 wallet extensions: Phantom, Trust Wallet, Atomic Wallet, Coinbase Wallet, OKX Wallet, MetaMask, and Tonkeeper. The malware scanned the browser for installed extensions before replacing selected wallets with malicious copies.

Can a Microsoft-signed program still be used in malware?

A Microsoft-signed program can be abused in a malware chain when attackers pair it with a malicious component. This campaign used the legitimate OLEView program with a malicious DLL, allowing the attackers to use DLL sideloading and process hollowing to run Needle Stealer.

What should I do if my MetaMask extension suddenly looks different?

A changed MetaMask extension should be treated as a security warning if the change followed a suspicious download or prompted you for a password unexpectedly. Stop entering credentials, verify the extension through MetaMask’s official channels, and contact support from the provider’s official website.

Are QR codes in PDFs safe to scan?

QR codes in PDFs are not automatically safe to scan because they can send a phone to a phishing page. HP Wolf Security observed QR-code PDFs that moved victims from protected work PCs to phones before directing them to credential-stealing login pages.