HP Wolf Security Threat Insights Report: September 2026

Evidence record

HP Wolf Security report covering Q2 2026 threats, including a campaign that used a fake AI crypto-trading assistant to distribute Needle Stealer and replace browser-wallet extensions.

Read the original source ↗

Claim-level citations (3)

• supportsFake AI crypto-trading assistant delivered Needle Stealer and replaced browser wallets: HP Sure Click detected a Q2 2026 campaign in which tradingclaw[.]pro posed as an AI cryptocurrency trading assistant and used search-engine poisoning and paid advertising to lead victims to a ZIP installer carrying Needle Stealer.

  Notable Threats, AI Agent to Manage your Crypto Assets, report page 3, paragraphs describing tradingclaw[.]pro, search-engine poisoning, paid advertising and the ZIP installer

• supportsFake AI crypto-trading assistant delivered Needle Stealer and replaced browser wallets: The replacement extension could transmit an entered wallet password to attacker-controlled infrastructure; HP states that entering the wallet identifier and password into the fake extension gives the attacker access to the wallet's funds.

  Report page 4, paragraphs describing C2 commands, wallet-password transmission and access to wallet funds

• supportsFake AI crypto-trading assistant delivered Needle Stealer and replaced browser wallets: Needle Stealer checked installed browser extensions against hardcoded IDs for seven cryptocurrency wallets: Phantom, Trust Wallet, Atomic Wallet, Coinbase Wallet, OKX Wallet, MetaMask and Tonkeeper, and attempted to replace matching extensions with infected versions.

  Report page 4, list of seven targeted cryptocurrency-wallet extension IDs and replacement procedure