Fake AI Trading Agent Lures Victims Into Wallet-Stealing Malware

Attackers are exploiting the booming interest in artificial intelligence and cryptocurrency trading with a fake AI trading agent that installs a credential-stealing malware family known as Needle Stealer. The campaign, observed between April and June 2026, targets people who search for AI agents and download them from search results or advertisements. The lure is a website that promises an automated agent capable of trading crypto around the clock. Instead of a functional trading bot, the download contains a ZIP archive with a file named Trading Agent.exe. That executable is not a trading program at all. It is a legitimate, Microsoft-signed utility called OLEView. Because it carries a valid digital signature, Windows SmartScreen treats it as trustworthy. Its only purpose in this attack is to pass that reputation check. Once launched, OLEView loads a malicious library named iviewers.dll from the same folder. This technique, known as DLL side-loading, allows the attacker to run code inside a trusted process. The DLL then executes Needle Stealer through process hollowing, a method that starts a legitimate process in a suspended state and replaces its memory with malicious code. The result is a stealthy infection that is difficult for traditional security tools to spot.

Needle Stealer is designed specifically for browser-based cryptocurrency wallets. It searches for seven different wallet extensions, including MetaMask, Coinbase Wallet, and Phantom. When it finds one, it kills the browser, unpacks a malicious copy into the extension folder, and waits. The next time the victim opens the browser and unlocks the wallet, the fake extension contacts the attacker’s command server and sends the password. With the wallet identifier and password, the attacker can control the funds. The victim may see a familiar unlock screen and assume everything is normal. However, a familiar interface does not prove that the extension is the one originally installed. The campaign shows how AI-themed lures can be combined with established malware techniques to target high-value crypto assets. It also highlights the importance of keeping wallet passwords and payment activity away from agent apps that cannot be verified.

How the Attack Chain Works

The attack chain begins with a promise. The fake site offers an AI agent that will trade crypto continuously. Users who download the agent receive a ZIP file. Inside is the signed OLEView executable and a malicious DLL. When the user runs the executable, Windows sees a trusted signature and allows it to start. The executable then loads the DLL from the same directory. This is a classic DLL side-loading attack. The DLL uses process hollowing to inject Needle Stealer into a legitimate process. Once running, Needle Stealer scans for the targeted browser wallet extensions. It terminates the browser, replaces the wallet extension with a malicious version, and waits for the user to type the wallet password. The malicious extension then exfiltrates the password to a remote server. With that password and the wallet ID, the attacker can drain the wallet.

Each stage is designed to evade detection. The signed executable bypasses SmartScreen reputation checks. DLL side-loading hides the malicious code inside a trusted process. Process hollowing makes the malicious code appear to be part of a legitimate program. The wallet extension replacement is especially dangerous because it does not require a separate phishing page. The user continues to interact with what looks like their normal wallet. The only difference is that the password is being copied and sent to an attacker. This type of attack is difficult to detect with signature-based antivirus alone. It requires behavioral monitoring, application control, and user awareness.

Defenders should treat downloads of AI agents with the same caution as any other executable. A website that promises automated crypto profits is a red flag, especially when the download is a ZIP file containing an executable. Users should verify the publisher, use official app stores where possible, and avoid running unsigned or unfamiliar binaries. For crypto holders, hardware wallets provide a stronger boundary because the private keys never leave the device. Browser wallets are convenient but they are also a high-value target. Keeping large balances in a browser extension is risky. Separating trading activity from long-term storage reduces the impact of a successful compromise.

QR Code Phishing Pushes Victims to Less Protected Phones

While the fake AI agent campaign targets desktop browsers, another set of campaigns uses QR codes to move victims onto their phones. Researchers identified emails containing PDF invoices. The PDF shows a blurred document behind a QR code and a note telling the recipient to scan the code with a smartphone. This technique is known as quishing, or QR code phishing. The scan passes through several redirects, including a fake email security scanner and a Cloudflare Turnstile check that confirms a human is loading the page. The victim then lands on a page that resembles OneDrive and is asked to enter Microsoft credentials.

The move to a phone is deliberate. A work PC often has email gateways, browser protections, and endpoint detection that may already block a known phishing domain. A phone usually carries fewer defenses. A link that would be stopped on a desktop may load without warning on a mobile device. The small screen also makes it harder to inspect the full URL. Users may not notice that the address is not the real service. The QR code itself can bypass email security because it is an image, not a clickable link. The email gateway cannot easily scan the destination behind the QR code. The user becomes the bridge between the email and the malicious site. This cross-device attack path is becoming more common as attackers look for gaps in enterprise security. Organizations need to protect mobile devices as rigorously as desktops. That includes mobile threat defense, phishing-resistant authentication, and user training that covers QR codes.

Phantom Stealer Sold With Customer Support

A separate malware family called Phantom Stealer is sold openly on the web as a penetration testing tool. The product comes with a crypter that encrypts it against analysis, regular feature updates, and 24/7 customer support. Buyers must agree not to use it for malicious purposes, but the tool is clearly marketed to a criminal audience. Researchers isolated several email campaigns delivering Phantom Stealer. In each campaign, a VBScript built a PowerShell command that fetched an ordinary-looking image. The image contained a hidden .NET loader, extracted using steganography. A component named Phantom Gate, built into the PowerShell script, started that loader. The loader then downloaded the stealer, decoded it, and injected it into RegAsm, a legitimate .NET Framework process. This delivery chain is similar to the Needle campaign. The shared naming and the use of process injection suggest that one threat actor may be behind both tools.

The sale of malware with support services reflects the professionalization of cybercrime. Criminal groups operate like software vendors, offering updates, compatibility fixes, and help desks. The crypter helps the malware evade detection. The support ensures that buyers can keep using the tool even as security products improve. The use of legitimate .NET processes for injection makes detection harder. RegAsm is a normal part of Windows, so security tools may not immediately flag its activity. The loader can also change its payload, making it harder for defenders to block by file hash. This combination of commercial support, encryption, and living-off-the-land techniques makes Phantom Stealer a persistent threat.

Users move constantly between devices and applications, like browsers or new AI tools, and attackers are quick to follow. Security needs to work across all of those interactions, without getting in people’s way. That means organizations need a zero-trust approach built around isolation and containment, so untrusted clicks and downloads do not become a risk.

That perspective underscores why the fake AI agent, QR phishing, and Phantom Stealer campaigns are not isolated incidents. They are part of a broader pattern in which attackers follow users across browsers, phones, and new AI tools. A zero-trust approach treats every device and interaction as potentially untrusted. Isolation and containment can prevent a single click from turning into a full compromise. For individuals, the lesson is to slow down before installing new agents or scanning QR codes. For organizations, the lesson is to extend security controls beyond the traditional desktop perimeter.

Invoice Campaigns Deliver XWorm, PureLogs and Formbook

Other invoice-themed campaigns arrived in two ways. Some used HTML smuggling, a technique that assembles the malicious file on the victim’s machine. Because the file is built locally, it can slip past email gateway scanners that only inspect attachments. Others relied on search results leading to lookalike domains. Both routes ended with loaders that decoded payloads hidden in images and installed XWorm, PureLogs Stealer, or Formbook. These malware families steal credentials, browser data, and system information. A perceptual-hash search of VirusTotal, which matches images by how they look rather than by exact file hash, turned up about 400 distinct images tied to these campaigns over three months. That number indicates a large and active operation. Attackers are reusing image templates and changing small details to avoid detection. Perceptual hashing helps defenders find related samples even when the file hash changes. It also shows how important it is to monitor for visual similarities across campaigns, not just known indicators of compromise.

HTML smuggling is effective because it splits the malicious payload into pieces that are assembled in the browser. The email may contain no suspicious attachment. The payload is encoded in the HTML or downloaded in chunks. Once assembled, it runs on the victim’s machine. Lookalike domains are equally effective because users often trust search results. A domain that resembles a legitimate service can appear at the top of search rankings through ads or search engine optimization poisoning. The combination of HTML smuggling and lookalike domains gives attackers multiple paths to the same goal. The loaders then hide their payloads in images, a form of steganography. This makes the malicious code harder to detect because the image looks harmless. The final payloads, XWorm, PureLogs Stealer, and Formbook, are all capable of stealing sensitive data. Formbook, for example, has been used for years to log keystrokes, capture screenshots, and steal credentials from browsers. PureLogs Stealer focuses on credentials and crypto wallets. XWorm is a remote access trojan that can download additional modules. Together, they represent a broad threat to both individuals and organizations.

Fake Installers and Search Hijacking

Researchers also traced a Russian-language imitation of a Microsoft site. The site offered an installer that bundled other products for affiliate payouts and never installed the promised word processor. The bundled security product eventually flagged the installer as dangerous and deleted it. That unusual sequence shows how affiliate-driven installers can turn against their own creators. More importantly, two signed installers, UltraZip and AllFiles, were found to hijack the default search engine and keep the change even after uninstall. This persistence is a common feature of unwanted software. Even if the installer does not steal crypto wallet passwords, it can redirect searches, inject ads, and expose users to further malicious content. Signed installers are especially problematic because users and security tools may trust them. A valid signature does not guarantee that the software is safe. It only means that the file has not been modified since it was signed. The publisher may still bundle unwanted programs or engage in deceptive practices.

The fake installer trend fits the same theme as the AI trading agent. Attackers use trusted brands, signed files, and search results to reach victims. They promise a useful tool, then deliver something else. In the AI trading agent case, the payload is a wallet stealer. In the fake installer case, the payload is adware, search hijacking, and bundled software. The common thread is deception. Users are tricked into running a file that appears legitimate. Once executed, the file can install additional payloads, change browser settings, or steal credentials. Defenders should monitor for changes to browser search settings and extension folders. They should also restrict the execution of unsigned or newly signed binaries. Application allowlisting can prevent many of these attacks because only approved programs are allowed to run. For home users, the best defense is to download software only from official sources and to read installation screens carefully. Unchecking bundled offers is not always enough, because some installers hide the opt-out or ignore it. A clean virtual machine or sandbox can help when testing unfamiliar software.

The broader lesson from these campaigns is that attackers are constantly adapting their lures to current interests. AI is the latest hook. Crypto remains a high-value target. QR codes and mobile devices open new paths around desktop defenses. Malware is sold with customer support, and payloads are hidden in images to evade detection. The attack surface now includes browsers, phones, AI tools, and software installers. Security controls must cover all of them. Isolation, containment, and zero-trust principles can reduce the risk that a single untrusted click or download becomes a full breach. The persistence of search hijacking after uninstall shows that even low-level unwanted installers can leave lasting changes that affect user privacy and security.

Source:Help Net Security News