Fake "AI Trading Agent" Site Delivers Needle Stealer, Which Swaps Victims' Crypto Wallet Extensions for Copies

Cryptocurrency users searching for AI trading agents, and seven browser wallet extensions including MetaMask, Coinbase Wallet, and Phantom

HP published research on September 17, 2026 on a campaign it caught between April and June 2026 that advertised a fake AI crypto trading agent at `tradingclaw[.]pro`. The download bundled OLEView, a legitimate Microsoft-signed tool, which side-loaded a malicious DLL that deployed Needle Stealer through process hollowing. Needle replaces seven wallet extensions with look-alike copies that capture the wallet password and send it to the attacker. HP linked about 400 distinct malicious images to related campaigns over three months, and the operators also used QR codes to move victims from desktop to mobile, where defenses are weaker

Demand for autonomous trading agents is a lure in itself. Victims are asked to install and trust software whose whole purpose is to act on their wallets, which is exactly the access a stealer wants