{"id":13403,"date":"2026-09-18T05:42:41","date_gmt":"2026-09-18T05:42:41","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=13403"},"modified":"2026-09-18T05:42:41","modified_gmt":"2026-09-18T05:42:41","slug":"fake-ai-crypto-software-is-secretly-replacing-browser-wallet-extensions","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=13403","title":{"rendered":"Fake AI crypto software is secretly replacing browser wallet extensions"},"content":{"rendered":"

<\/p>\n

\n

HP Wolf Security, the company’s threat-research team, said a fake AI crypto-trading assistant distributed malware that could replace browser crypto wallet extensions on an infected Windows computer and turn the familiar wallet interface into a credential trap.<\/p>\n

The campaign appeared in HP’s September threat report, published Sept. 17 and based on threats observed from April through June 2026. HP described a compromise that began on a user’s endpoint after a counterfeit trading tool was downloaded and run, not a breach of Coinbase, MetaMask, or their official extensions.<\/p>\n

Malwarebytes had documented the TradingClaw campaign in April and found that Needle Stealer also circulated through other malware loaders. The fake AI assistant was one route into a broader malware operation.<\/p>\n

\n

Related Reading<\/span><\/p>\n

Hackers sneak crypto wallet-stealing code into a popular AI tool that runs every time<\/h3>\n<\/p>\n

<\/span> <\/div>\n

Attackers promoted tradingclaw[.]pro as an AI assistant that could follow a personalized strategy and trade around the clock, according to the full HP report. Search-engine poisoning and paid advertisements directed prospective victims to a ZIP file presented as the software’s installer.<\/p>\n

The archive contained an executable named Trading Agent.exe and a DLL named iviewers.dll. HP identified the executable as OLEView, Microsoft’s legitimate, digitally signed OLE\/COM Object Viewer. HP said the signed program helped bypass Microsoft’s SmartScreen reputation check, while the malicious payload remained in the accompanying DLL.<\/p>\n

Running the trusted-looking program caused it to load that DLL. The code then decrypted Needle Stealer and used process hollowing, a technique that runs malicious code inside a newly launched legitimate process.<\/p>\n