Fake AI Trading Assistant Replaces Browser Crypto Wallet Extensions with Malware

HP Wolf Security’s threat‑research team uncovered a campaign in which a fake AI crypto‑trading assistant was used to deliver malware that replaces popular browser wallet extensions with malicious versions. The operation targets Windows computers and does not involve a breach of the wallet providers themselves.

How the malicious replacement works

The attacker distributes a ZIP file disguised as an AI trading tool. Inside the archive are Trading Agent.exe—identified as Microsoft’s signed OLE/COM Object Viewer (OLEView)—and a DLL named iviewers.dll. The signed executable bypasses Microsoft SmartScreen, loads the DLL, and then uses process hollowing to run the malicious code.

Targeted wallet extensions

Once executed, the malware enumerates Chromium‑based extensions and matches their 32‑character IDs against a hard‑coded list that includes:

• Phantom
• Trust Wallet
• Atomic Wallet
• Coinbase Wallet
• OKX Wallet
• MetaMask
• Tonkeeper

When a match is found, the browser is shut down and the legitimate extension folder is overwritten with a counterfeit extension that connects to the attacker’s command‑and‑control server.

Credential harvesting

The fake extension presents realistic login screens. Any wallet ID and password entered are captured and sent to the attacker. Because the replacement runs on an already compromised device, locally stored funds are at risk even though the password alone cannot restore a wallet elsewhere.

Broader malware context

The operation, dubbed “TradingClaw,” was first documented by Malwarebytes in April 2026. The fake AI assistant serves as one entry point for the larger “Needle Stealer” malware family, which has been observed in multiple loader campaigns.

Impact and unknowns

HP’s report does not provide a total victim count or estimate of crypto losses, leaving the overall scale of the campaign unclear.