Fake AI Crypto Tools Replace Wallet Extensions—How to Spot the Trap

A security report by tech giant HP has highlighted the rising threat of attackers using fake AI crypto trading tools to deliver malware that replaces legitimate browser-wallet extensions and steals wallet passwords.

HP noted this in its September 2026 Wolf Security Threats Insight Report, describing it as the latest technique cybercriminals deploy against unsuspecting internet users. According to HP’s report, attackers built a website camouflaging itself as an AI-powered crypto trading assistant, borrowing the name of a well-known AI tool to seem trustworthy, and used it to spread Needle Stealer.

Hackers’ Soft Targets

The hackers targeted users looking for AI bots to grow their portfolio. The users instead downloaded malware that used a legitimate Microsoft-signed program to sneak in a malicious file. The malware quietly swapped their browser’s cryptocurrency wallet for a fake one. Once they typed in their wallet password, the attackers had everything they needed to empty it.

Other strategies that HP reported include phishing campaigns that hid a QR code inside a PDF invoice. In this case, attackers coaxed potential victims to use their phones and scan QR codes on the invoice. That strategy moves them away from the protections guarding a work PC. So, even after blocking a threat on a computer, hackers could still access their targets through mobile devices.