HP warns of AI lures & QR phishing targeting crypto

JOSEPH GABRIEL LAGONSIN News Editor

HP has published new threat research on cybercriminal tactics targeting AI users, mobile devices and cryptocurrency holders, based on campaigns observed by HP Wolf Security.

One campaign involved attackers advertising fake AI trading agents to cryptocurrency users and delivering malware instead of the promised software.

According to HP, the malicious program scanned victims' browsers for crypto wallet extensions, including Coinbase and MetaMask, then replaced them with fraudulent versions designed to capture credentials. Once users entered their details into the lookalike extensions, attackers could access their crypto holdings.

The campaign reflects a broader shift in how attackers are adapting popular technology themes into more convincing lures. In this case, interest in agentic AI was used to persuade users to install software that appeared legitimate.

Another campaign highlighted in the report involved QR code phishing designed to move victims from desktop or laptop computers to smartphones. Researchers said victims received PDF files stating that content was "blurred for security" and were then prompted to scan a QR code with their phones.

That process redirected users to phishing websites, potentially bypassing protections on their PCs and putting login details at risk. The tactic highlights a long-running challenge for security teams as attackers shift activity across devices to find weaker points of defence.