Fake AI crypto software is secretly replacing browser wallet extensions

HP Wolf Security, the company's threat-research team, said a fake AI crypto-trading assistant distributed malware that could replace browser crypto wallet extensions on an infected Windows computer and turn the familiar wallet interface into a credential trap.

The campaign appeared in HP's September threat report, published Sept. 17 and based on threats observed from April through June 2026. HP described a compromise that began on a user's endpoint after a counterfeit trading tool was downloaded and run, not a breach of Coinbase, MetaMask, or their official extensions.

Malwarebytes had documented the TradingClaw campaign in April and found that Needle Stealer also circulated through other malware loaders. The fake AI assistant was one route into a broader malware operation.

Attackers promoted tradingclaw[.]pro as an AI assistant that could follow a personalized strategy and trade around the clock, according to the full HP report. Search-engine poisoning and paid advertisements directed prospective victims to a ZIP file presented as the software's installer.

The archive contained an executable named Trading Agent.exe and a DLL named iviewers.dll. HP identified the executable as OLEView, Microsoft's legitimate, digitally signed OLE/COM Object Viewer. HP said the signed program helped bypass Microsoft's SmartScreen reputation check, while the malicious payload remained in the accompanying DLL.