Attackers built a website for a fake AI crypto trading agent and used it to install Needle Stealer, malware that swaps a victim's browser wallet extension for a counterfeit copy and forwards the wallet password to the attacker. HP's researchers tracked the campaign between April and June 2026. This analysis draws on reporting from Help Net Security.

The site, tradingclaw[.]pro, gave its bot a name that echoes a well-known AI assistant and promised an agent that trades crypto around the clock. The targets are people who find AI agents through search results or paid ads, which in practice means crypto traders, retail investors, and finance or operations staff testing new AI tools on whatever machine they happen to be using.

Needle looks for any of seven browser wallet extensions, including MetaMask, Coinbase Wallet and Phantom. It closes the browser, unpacks its own copy into the extension's folder, and waits. The next unlock screen you see looks exactly like the one you have always used, and the password you type goes to the attacker's command server. With the wallet ID and that password, the attacker controls the funds.

This is where it stops being a personal finance problem. Software downloaded from an ad on a corporate laptop or a BYOD phone runs with that user's access, and the same HP research covers a broader toolkit moving through invoice-themed email and lookalike download sites:

• XWorm, a remote access tool that gives an operator hands-on control of the machine
• Phantom Stealer, sold openly as a "penetration testing tool," and its Phantom Gate launcher component
• PureLogs Stealer and Formbook, both built to collect credentials and system data

Credentials collected from an employee's browser are the same credentials that open your email, file shares and finance systems. HP's advice to users is direct: keep wallet passwords and payment work out of agent apps you cannot verify.

From Trojanised Installer to XWorm: The Infection Chain

The ZIP download contains two files that matter: Trading Agent.exe and iviewers.dll. The executable is not attacker-written code at all. It is OLEView, a legitimate Microsoft-signed utility, and its only job in this campaign is to satisfy Windows SmartScreen's reputation check so the download runs without a warning prompt.

Once OLEView launches, it loads the attacker's iviewers.dll sitting next to it, a technique called DLL side-loading (MITRE T1574.002) where a trusted binary is tricked into loading an untrusted library from its own directory. The DLL then starts a fresh legitimate process and runs Needle Stealer inside it, a technique called process hollowing (T1055.012). Every stage that your endpoint tooling sees is either a signed Microsoft binary or a normal system process, which is exactly why reputation-based controls pass it through.

The stealer's wallet swap is mechanically simple. It enumerates the browser profile for any of the seven supported extensions, terminates the browser so the extension folder is unlocked, and unpacks a counterfeit copy into that folder. The next unlock screen looks identical because it is a rebuilt version of the real interface, and the password typed into it goes to the operator's command server along with the wallet ID.

HP isolated a separate set of email campaigns delivering Phantom Stealer, which is sold openly as a "penetration testing tool" bundled with a crypter, feature updates and 24/7 support. Buyers are asked to agree not to use it maliciously. The delivery chain runs through several stages:

• A VBScript in the attachment assembles a PowerShell command at runtime (T1059.005 into T1059.001).
• PowerShell fetches an ordinary-looking image and extracts a .NET loader hidden inside the pixel data, a method called steganography (T1027.003).
• A component named Phantom Gate, built into the PowerShell script, executes that loader.
• The loader downloads the stealer, decodes it, and injects it into RegAsm.exe, a legitimate .NET Framework process.

Researchers noted that the shared naming and the common delivery chain point to one threat actor behind both Phantom Gate and Phantom Stealer. For a defender, the practical consequence is that the malicious payload never touches disk as an executable file. It arrives as an image and lives inside a Microsoft-signed .NET process.

Other invoice-themed campaigns reached victims two ways. Some used HTML smuggling, where the attachment's script assembles the malicious file locally in the browser so the email gateway only ever scans benign HTML. Others used search results pointing at lookalike domains. Both routes ended in loaders that decoded image-hosted payloads and installed XWorm, PureLogs Stealer or Formbook, which harvest credentials and system data. XWorm in particular gives an operator interactive remote access to the host, so credential theft is the starting point rather than the full extent of the incident.

A perceptual-hash search of VirusTotal, which matches files by how the images look rather than by hash value, surfaced roughly 400 distinct images tied to these campaigns across three months. That volume tells you the image-as-container method is being reused at scale by whoever is running the loaders.

A separate strand involved fake installers. A Russian-language imitation of Microsoft's site served an installer that bundles third-party products for affiliate payouts and never installs Word, and the bundled security product then flags the installer that delivered it and deletes it. Two signed installers, UltraZip and AllFiles, hijack the browser's default search engine and keep that change in place after the user uninstalls them.

What a Wallet Compromise Costs Beyond the Stolen Funds

Crypto theft does not reverse. There is no chargeback, no issuing bank to dispute the transfer with, and no intermediary who can freeze the destination address once a transaction confirms. If an attacker holds your wallet ID and the password you typed into a counterfeit extension, the funds move on their schedule, not yours.

The loss also extends past the one wallet that was drained. Recovering means generating new wallets, moving any remaining balances before the attacker does, and reissuing addresses to every counterparty, exchange, and payroll process that pays you. For a firm that custodies or transacts client digital assets, that migration work is a project with a schedule and a communications plan attached, and it happens while clients are asking questions.

The business exposure sits on the endpoint, not the blockchain. The same HP research traced invoice campaigns that ended with XWorm installed on the victim's machine. XWorm is a remote access trojan, meaning the operator has interactive control of that computer: they can run commands, capture what you type, pull files, and push additional payloads whenever they choose. A single infected laptop in your finance or operations team becomes a staging point for whatever the operator decides to do next, and ransomware deployment is a common next step in campaigns that begin this way.

Alongside XWorm, those campaigns delivered PureLogs Stealer and Formbook, which collect credentials and system data. That matters because the browser your staff use for a wallet extension is usually the same browser holding saved logins to your Microsoft tenant, your accounting platform, your CRM, and your file storage. Stealers that read browser data typically collect saved passwords along with active session material, so an attacker can resume an authenticated session without ever facing a second-factor prompt. Your MFA policy stays enabled and the account still gets used.

From there the pattern is familiar. Stolen mailbox access supports invoice fraud and internal phishing that arrives from a real colleague's address. Reused passwords open adjacent systems, and because the logins are legitimate, your access logs show a normal user doing normal things from an unusual place.

The cost you actually book is operational. You pay for an incident response engagement to determine what the operator did during the access window, and you rotate credentials for every account that touched the affected browser profile, which in practice means a forced reset cycle across staff who had nothing to do with the original download. You rebuild the endpoint rather than clean it. If the harvested credentials reached systems holding personal or customer data, you are into a disclosure assessment with your regulator and possibly your clients, on their statutory timeline rather than yours.

For firms that advise on or hold client digital assets, the reputational piece is concrete. Clients who learn their wallet details passed through your compromised environment will ask who else had access, and some will move their accounts. Document the access window and what data was reachable, because that is the question every client, insurer, and regulator will put to you first.

Detection Signals and Containment Steps

Start by pulling the affected machine off the network. Any host where someone installed a downloaded AI trading tool should be treated as fully compromised, not cleaned in place, because the stealer ran with the user's own rights and had free access to everything the browser stored.

Once the host is isolated, assume every seed phrase, private key and exported keystore file that ever touched it is in attacker hands. Generate new wallets on a separate, known-clean device and move funds there before you begin forensics. Do not type the old password into the old machine again, even to check a balance.

Then rotate credentials, and rotate them from a different device. Browser-saved passwords, autofill data and session cookies are all in scope, so a password change alone leaves an attacker holding a live session. Invalidate active sessions in Microsoft 365, Google Workspace, your exchange accounts and anything else with a "sign out everywhere" control.

For hunting, focus your EDR queries on the trusted binary behaving oddly:

• OLEView executing from user-writable locations such as %USERPROFILE%\Downloads, %APPDATA% or a temp folder, rather than a developer tools install path.
• Any module load of iviewers.dll from a directory that is not an SDK install, and any Microsoft-signed process loading a DLL from the same folder it was unzipped into.
• Browser processes terminated abruptly followed by file writes into extension folders under %LOCALAPPDATA%, which is how a counterfeit wallet extension gets unpacked into place.
• RegAsm.exe spawning with no build or deployment activity around it, and with outbound network connections, which indicates the injected payload HP observed in the Phantom Stealer chains.
• VBScript launching PowerShell that downloads image files, the steganography step used to hide a .NET loader inside an ordinary-looking picture.

In environments Capstone manages, Adlumin ITDR correlates the authentication side of this, catching logins from new locations or impossible-travel patterns that indicate the harvested passwords and cookies are already in use elsewhere across managed environments.

Over the next week, block the campaign infrastructure at your DNS and firewall layer, including tradingclaw[.]pro and the lookalike download domains your users reached through search results and paid ads. Add the payload hashes to your blocklist. Then sweep for XWorm persistence across the rest of the estate, checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run, Scheduled Tasks created outside your patch windows, and Startup folder entries. Review outbound traffic on non-standard ports and watch for clipboard monitoring behaviour, since wallet address substitution is a common follow-on.

Also audit browsers for hijacked default search settings. HP found two signed installers, UltraZip and AllFiles, that change the default search engine and keep the change after uninstall, so removing the program does not restore the original setting.

Structurally, application allowlisting is the control that stops this class of download from running at all, because the attacker's delivery method depends on a signed Microsoft binary passing a reputation check. Pair it with removing local administrator rights from standard users. Disable browser password storage and move staff onto Passportal so credentials are not sitting in a profile a stealer can copy. Keep crypto operations on hardware wallets and dedicated devices, away from the machines people use for email and web browsing. Finally, add fake AI tool lures and QR-code invoice emails to your awareness training, naming the specific pattern of a search ad promising an autonomous trading agent.

Treating AI Tool Downloads as an Acquisition Risk

The fake trading agent is one delivery route among several HP documented in the same April to June 2026 window. The others end in XWorm, PureLogs Stealer and Formbook, arriving through HTML smuggling that assembles the payload on the machine itself, or through search results pointing at lookalike domains. A perceptual-hash search of VirusTotal matched roughly 400 distinct images carrying hidden payloads across three months, which tells you how industrialised this delivery work has become.

The economics explain the pattern. Phantom Stealer is sold openly as a "penetration testing tool" with a crypter, feature updates and 24/7 customer support, and buyers agree not to use it maliciously. Your adversary here is often a paying customer of a product, not an author of one, and the AI branding is simply the wrapper that gets someone to run the installer.

Signed software gives no assurance on its own. Two signed installers HP examined, UltraZip and AllFiles, hijack the default search engine and hold that change after uninstall, and a Russian-language imitation of Microsoft's site bundled affiliate products while never installing Word at all.

Treat AI tool acquisition the way you treat any other software purchase. The single most important control is a vetting and allowlisting process that decides which AI applications are permitted before anyone installs one, with a named owner who approves additions. Where that process does not exist, any endpoint that ran an unvetted AI tool should be handled as compromised until you have established otherwise.