Cybercriminals Use Fake AI Agents to Steal Crypto Wallets

• •Fake AI trading agents are being used to distribute malware targeting crypto wallets.
• •Needle Stealer malware replaces legitimate browser extensions to harvest user credentials.
• •QR code phishing tactics are redirecting users to less secure mobile environments.

Cybercriminals are exploiting interest in Agentic AI by creating fake AI trading agents to lure crypto users into downloading malware. This malware, known as Needle Stealer, replaces legitimate browser wallet extensions like MetaMask and Coinbase with malicious versions that capture user credentials. The attacks were identified between April and June 2026, targeting users of seven specific browser wallet extensions. Additionally, QR code phishing tactics are being employed to redirect victims to less secure mobile environments. HP's Threat Insights Report highlights the growing sophistication of these attacks, including the use of a new malware loader called Phantom Gate. The current status indicates ongoing campaigns with significant risk to crypto users. Organizations are urged to remain vigilant and implement security measures to protect against these threats.