Fake AI Agents Used to Steal Cryptocurrency Wallets in Sophisticated Malware Scam

Cybercriminals are using fake artificial intelligence (AI) agents to trick users into installing malware that replaces legitimate cryptocurrency wallet extensions and steals their passwords.

The maneuver was detected between April and June by HP, which analyzed millions of devices protected by its Wolf Security software to identify recent campaigns and the methods used to evade detection systems.

The attackers promise a tool that monitors cryptocurrency portfolios and operates automatically, posing as an alternative to traditional financial advisors. However, the site tradingclaw distributed a family of malware called Needle Stealer, which scans browsers for wallet extensions, including Coinbase and MetaMask.

Once installed, the program replaces the wallet extensions with visually similar copies, allowing victims to enter their login details and hand over their credentials to the attackers. Patrick Schläpfer, a principal researcher at HP Security Lab, warned that attackers are leveraging the adoption of agentic AI tools to develop new lures.