Fake AI Trading Bot Installs Needle Stealer Malware to Hijack Browser Crypto Wallets

HP's threat-research team identified a campaign where attackers used search-engine poisoning to promote a fake AI assistant called tradingclaw[.]pro. The downloaded installer contained a legitimate, digitally signed Microsoft OLE/COM Object Viewer executable that loaded a malicious DLL, allowing the payload to bypass SmartScreen reputation checks. Once running, Needle Stealer used process hollowing to enumerate Chromium browser extensions, checking 32-character IDs against a hardcoded list to locate 7 specific wallets, including Phantom, MetaMask, and Coinbase Wallet. The malware then shut down the browser and extracted a malicious copy into the existing extension folder, presenting victims with realistic counterfeit login screens. Any crypto wallet ID and password entered into the substituted extension was sent directly to a command-and-control server operated by the attackers. HP did not disclose aggregate crypto-loss figures or a total victim count for the campaign, which operated from April through June 2026.