Fake AI crypto software replaces browser wallet extensions

HP Wolf Security reported a malware campaign that uses a fake AI crypto-trading assistant to replace browser crypto wallet extensions on infected Windows computers. This compromise occurs after users download and run a counterfeit trading tool, not through breaches of platforms like Coinbase or MetaMask. The campaign, detailed in HP's September threat report, identified a malicious ZIP file that contained an executable named Trading Agent.exe, which masquerades as a legitimate Microsoft program, allowing it to bypass security checks. Once executed, the malware decrypts Needle Stealer and employs process hollowing to run malicious code. Needle Stealer targets specific Chromium browser extensions, including Phantom, Trust Wallet, and MetaMask, shutting down the browser to extract a malicious extension into the existing folder. The replacement connects to an attacker's command-and-control server, capturing user credentials entered into a counterfeit interface. Although HP did not disclose the number of victims or total crypto losses, the operation poses significant risks to users with compromised devices.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.