Fake AI crypto app swaps browser wallets to steal keys

A fake AI crypto trading application delivered Needle Stealer by running a digitally signed Microsoft OLE/COM Object Viewer executable that loaded a malicious DLL and replaced browser wallet extensions on Windows machines.

HP Wolf Security reported the campaign was active on endpoints between April and June 2026 and published its findings on Sept. 17. The attackers promoted a site presenting an AI trading assistant through poisoned search results and paid advertisements. Visitors were offered a ZIP archive labeled as an installer that contained an executable named Trading Agent.exe and a DLL called iviewers.dll.

HP identified Trading Agent.exe as Microsoft’s legitimate OLEView tool. When the signed executable ran, it loaded the accompanying DLL. The DLL decrypted Needle Stealer and used process hollowing to run the malicious code inside a legitimate process.

Needle Stealer searched Chromium-based browsers for extensions, checked each extension’s 32-character ID against a hardcoded list, and when a match was found it shut down the browser and copied a malicious replacement into the extension folder. On first launch the substitute extension connected to the attacker’s command-and-control server and fallback domains and presented a realistic login interface that could capture credentials and wallet identifiers entered by the user.

The campaign targeted extensions identified as Phantom, Trust Wallet, Atomic Wallet, Coinbase Wallet, OKX Wallet, MetaMask and Tonkeeper. HP noted the signed OLEView executable reduced the likelihood that Microsoft’s SmartScreen reputation checks would block the download. The report did not provide a total victim count or an aggregate figure for crypto losses.

The report explained process hollowing as a technique that starts a legitimate process and replaces its memory with malicious code so the malware runs inside a trusted process. Browser extensions are stored in specific directories and are loaded from those files; replacing an extension file can make a user interact with a counterfeit interface while believing they are using the real wallet.

HP pointed out that local passwords used by some wallet providers, including MetaMask, unlock wallets only on the device where they were created and do not restore a wallet elsewhere. A substituted extension on a compromised machine can capture those local passwords or a secret recovery phrase if they are entered or accessible on the device, which can expose funds stored in the wallet.

Earlier analysis in April documented a broader TradingClaw operation that circulated Needle Stealer through multiple malware loaders. HP’s report indicates the fake AI assistant was one delivery path into that larger campaign rather than the sole method of distribution.

HP’s findings show the attack required users to download and run the bundled, signed utility and relied on established techniques to execute and exfiltrate the malware from infected endpoints.