Fake AI Trading Agents Swap Legit Extensions with Malicious Copies

HP Wolf Security has warned about a campaign to install malware that replaces legitimate browser-wallet extensions with malicious copies. The scam uses an AI trading-agent lure, promising an always-on trading product and a Windows download presented as a trusted Microsoft-signed program.

The targets of this campaign included established wallet-extension brands such as MetaMask, Coinbase Wallet, and Phantom. Between April and June 2024, the fake TradingClaw website advertised an AI trading agent that was supposed to operate around the clock, leading victims to run a Windows executable presented as Microsoft-signed.

Researchers identified the malware as Needle Stealer, which uses DLL side-loading to replace legitimate wallet-extension files with malicious copies. This could leave a visible interface appearing to belong to a familiar service while collecting information for the operator.