The cited HP report does not establish a complete victim count. The report describes capability to capture wallet credentials and thereby obtain access to funds, but it does not provide a defensible aggregate realized-loss figure. The presence of seven targeted wallet-extension IDs describes targeting breadth and does not establish compromise of every…
Limits and uncertaintyCase · DiggingBeagle record
Fake AI crypto-trading assistant delivered Needle Stealer and replaced browser wallets
HP Wolf Security observed a Q2 2026 campaign in which a website posing as an AI-powered crypto-trading assistant distributed Needle Stealer. The infection chain used a legitimate Microsoft-signed executable to load a malicious DLL, after which the malware targeted seven Chromium cryptocurrency-wallet extensions and attempted to replace matching wallets with malicious versions capable of collecting wallet credentials.
Public disclosure: Sep 17, 2026
Scope
Observed Q2 2026 malware campaign reported by HP Wolf Security. The campaign used a fake AI cryptocurrency-trading assistant as a lure and targeted installed Chromium wallet extensions. The Source supports the infection and credential-theft mechanisms but does not provide an aggregate victim count or realized financial-loss total.
At a glance
Claims & evidence
CLM-NEEDLE-AI-TRADING-LUREHP Sure Click detected a Q2 2026 campaign in which tradingclaw[.]pro posed as an AI cryptocurrency trading assistant and used search-engine poisoning and paid advertising to lead victims to a ZIP installer carrying Needle Stealer.supported
Basis: reported finding
- supportsHP Wolf Security Threat Insights Report: September 2026primary disclosure
Notable Threats, AI Agent to Manage your Crypto Assets, report page 3, paragraphs describing tradingclaw[.]pro, search-engine poisoning, paid advertising and the ZIP installer
CLM-NEEDLE-WALLET-PASSWORDThe replacement extension could transmit an entered wallet password to attacker-controlled infrastructure; HP states that entering the wallet identifier and password into the fake extension gives the attacker access to the wallet's funds.supported
Basis: reported finding
- supportsHP Wolf Security Threat Insights Report: September 2026primary disclosure
Report page 4, paragraphs describing C2 commands, wallet-password transmission and access to wallet funds
CLM-NEEDLE-WALLET-REPLACEMENTNeedle Stealer checked installed browser extensions against hardcoded IDs for seven cryptocurrency wallets: Phantom, Trust Wallet, Atomic Wallet, Coinbase Wallet, OKX Wallet, MetaMask and Tonkeeper, and attempted to replace matching extensions with infected versions.supported
Basis: reported finding
- supportsHP Wolf Security Threat Insights Report: September 2026primary disclosure
Report page 4, list of seven targeted cryptocurrency-wallet extension IDs and replacement procedure
Unknowns and contradictions
- The cited HP report does not establish a complete victim count.
- The report describes capability to capture wallet credentials and thereby obtain access to funds, but it does not provide a defensible aggregate realized-loss figure.
- The presence of seven targeted wallet-extension IDs describes targeting breadth and does not establish compromise of every listed wallet product or every user of those products.
Sources and citation
Material revision history
- Sep 25, 2026 · Published version · first publication · revision 50