HP uncovers fake AI trading bot replacing crypto wallet extensions
In brief
- HP Wolf Security identified malware replacing Phantom, MetaMask, Coinbase Wallet, and four other extensions
- Attackers promoted tradingclaw[.]pro as an automated AI trading assistant
- Malware used Microsoft's signed OLEView tool to bypass SmartScreen and inject credential stealers
The attack chain
The compromise began when users downloaded and ran a counterfeit trading tool, not through a breach of Coinbase, MetaMask, or their official extensions. Attackers promoted tradingclaw[.]pro as an AI assistant that could follow a personalized strategy and trade around the clock.
The malware installer archive contained an executable named Trading Agent.exe and a DLL named iviewers.dll. HP identified the executable as OLEView, Microsoft's legitimate, digitally signed OLE/COM Object Viewer. The signed program helped bypass Microsoft's SmartScreen reputation check while the malicious payload remained in the accompanying DLL.
Once executed, the code decrypted Needle Stealer and used process hollowing, a technique that runs malicious code inside a newly launched legitimate process.
Targeting wallet extensions
Needle Stealer enumerated Chromium browser extensions and checked their 32-character IDs against a hardcoded list covering seven targets: Phantom, Trust Wallet, Atomic Wallet, Coinbase Wallet, OKX Wallet, MetaMask, and Tonkeeper. When the malware found a target wallet extension, it shut down the browser and extracted a corresponding malicious extension into the existing extension folder.
The replacement extension connected to a command-and-control server and loaded backup domains on its first launch. The attackers had built realistic login screens, and a crypto wallet ID and password entered into a counterfeit interface could be sent to the operator.
Even with MetaMask's security design (where the password unlocks the wallet locally and cannot restore it elsewhere), the substituted extension was operating on an already compromised device, leaving locally accessible funds at risk.
Campaign scale unknown
Malwarebytes had documented the TradingClaw campaign in April and found that Needle Stealer also circulated through other malware loaders. HP's report did not disclose a campaign-wide victim count or aggregate crypto-loss figure, leaving the operation's scale unknown.
