A fake artificial intelligence trading agent is being used as bait to install malware that quietly replaces the cryptocurrency wallet extension in a victim’s browser with a copy designed to hand over the wallet password. Security researchers observed the campaign between April and June 2026. The operation targets people who download AI agents from search results or advertisements, and it also affects users of seven browser wallet extensions, including MetaMask, Coinbase Wallet and Phantom. The same research uncovered QR code phishing that moves victims from a computer to a phone, where security protections are often weaker.
A trusted installer with a malicious payload
The lure is a website that promises a downloadable bot for automated cryptocurrency trading. The bot is given a name that echoes a well-known AI assistant and is marketed as an agent that can trade crypto around the clock. The site offers an installer packaged inside a ZIP archive. The executable file is not a trading tool. It is a Microsoft-signed program called OLEView, which means Windows SmartScreen’s reputation check is more likely to trust it. Its only purpose in the attack is to get past that check. When the executable runs, it loads a malicious file beside it, a DLL named iviewers.dll. This technique is known as DLL side-loading.
The DLL then runs Needle Stealer inside a newly started legitimate process, a technique called process hollowing. The malware searches for any of the seven targeted wallet extensions, terminates the browser, and unpacks a malicious copy into the extension’s folder. The fake extension contacts the attacker’s command server and captures whatever password the victim types. With the wallet identifier and password, the attacker can control the funds. A familiar unlock screen does not prove that the extension is the one the user originally installed.
Why the AI trading lure works
AI trading agents combine two powerful themes: automation and financial gain. A promise of around-the-clock trading is attractive to people who want to believe that a small piece of software can monitor markets, react to price movements and generate returns without constant attention. Attackers exploit that interest by presenting a polished website, a downloadable installer and a name that sounds like a known AI assistant. The goal is to make the download feel ordinary, even urgent, so that the user runs it without checking the publisher.
Search results and paid advertisements add another layer of credibility. A user who searches for an AI trading bot may see a result that looks like a legitimate product page. The page can describe features, show screenshots and offer a direct download. The malware does not need to exploit a browser zero-day or break modern encryption. It only needs the user to trust the download and enter a wallet password into a malicious extension that looks familiar.
The wallet replacement step
Browser wallet extensions are small applications that live inside the browser. They store encrypted keys locally and ask for a password when the user wants to unlock the wallet. A fake copy does not need to break the encryption if it can capture the password at the moment of unlock. By replacing the extension’s files and restarting the browser, the attackers position their copy to receive the password the next time the victim tries to use the wallet. The wallet identifier and password are then enough to move funds.
This is why the campaign is more than a simple credential phishing page. The user may continue to see a familiar interface and may not notice that the extension has been swapped. The malicious copy can communicate with a command server, receive instructions and send back captured data. The theft can happen after the user believes the danger has passed.
Phones become the weaker link
Researchers also found QR code phishing campaigns that arrive by email. The messages carry PDF invoices showing a blurred document behind a QR code, with a note telling the recipient to scan the code with a smartphone. The method is known as quishing. The scan runs through redirects, including a fake email security scanner and a Cloudflare Turnstile check that confirms a person is loading the page. It then lands on a page resembling OneDrive and asks for Microsoft credentials.
A work computer may have email gateways, browser protections and endpoint controls that already block a known phishing domain. A phone usually carries fewer defenses. A link that the desktop would stop may load on the phone, where the user is more likely to sign in without the same security prompts. Attackers use the QR code to move the victim from a protected device to a less protected one. The shift also makes the email look less suspicious because the message itself may contain only an invoice and a code.
A stealer sold with customer support
Phantom Stealer is sold openly on the web as a penetration testing tool, alongside a crypter that encrypts it against analysis, feature updates and 24/7 support. Buyers must agree not to use it for malicious purposes, but the tool is marketed in a way that makes abuse easy. Researchers isolated several email campaigns delivering it. A VBScript in each campaign built a PowerShell command that fetched an ordinary-looking image and pulled a .NET loader out of it, a method called steganography. A component named Phantom Gate, built into the PowerShell script, started that loader. The loader then downloaded the stealer, decoded it and injected it into RegAsm, a legitimate .NET Framework process.
The shared name and delivery chain suggest that one threat actor may be behind both tools. Security leaders say users move constantly between devices and applications, including browsers and new AI tools, and attackers are quick to follow. They argue that security needs to work across all of those interactions without getting in people’s way. That means organizations need a zero-trust approach built around isolation and containment, so untrusted clicks and downloads do not become a risk.
HTML smuggling, lookalike domains and rigged images
Other invoice campaigns arrived two ways. Some used HTML smuggling, which assembles the malicious file on the victim’s machine so it can slip past email gateway scanners. Others relied on search results leading to lookalike domains. Both routes ended with loaders that decoded payloads hidden in images and installed XWorm, PureLogs Stealer or Formbook, which steal credentials and system data. A perceptual-hash search of a malware intelligence platform, which matches images by how they look, turned up about 400 distinct images tied to these campaigns over three months.
The image-based delivery is notable because it turns ordinary files into containers for malicious code. A user may see a picture, a document preview or an invoice graphic. The loader knows how to extract the hidden payload and continue the chain. Lookalike domains add to the deception by placing the download behind a familiar brand or service name. The combination of HTML smuggling and steganography gives attackers flexibility to change file types and routes while keeping the same final objective.
Fake installers and affiliate bundles
Researchers also traced a Russian-language imitation of Microsoft’s site whose installer bundles other products for affiliate payouts and never installs Word. The security product it bundles then flags that installer as dangerous and deletes it. Two signed installers, UltraZip and AllFiles, hijack the default search engine and keep the change after uninstall.
Security guidance for wallet users is direct: keep wallet passwords and payment work out of agent apps that cannot be verified. A download from a search result or advertisement is not proof of legitimacy. A signed installer can still be repurposed. A familiar unlock screen can still belong to a malicious copy. The simplest defense is to avoid entering wallet credentials into software that has not been independently checked, and to treat any unexpected request to rescan, reinstall or unlock a wallet as a reason to stop and verify.
Source: Help Net Security News