Security researchers have documented a campaign that turns the promise of hands-off crypto profits into a direct line to a victim's wallet password. Attackers built a polished website advertising a fake AI crypto trading agent, then used the download to install a credential stealer that quietly swaps a browser wallet extension for a malicious copy. The activity was tracked between April and June 2026, and it sits inside a much broader wave of phishing and malware delivery that leans on everything from QR codes to image steganography.
A polished front built on borrowed credibility
The lure was designed for people who search for AI trading tools rather than for security warnings. The site gave its supposed bot a name that deliberately echoes a well-known AI assistant, and it promised an agent that would trade crypto around the clock without supervision. The landing page offered an installer, the kind of file a shopper for trading software would expect to double-click without a second thought. Traffic arrived through search results and paid ads, meaning victims were not necessarily following a suspicious link from a stranger; they were looking for a product and finding one that appeared to exist.
What they downloaded was a ZIP archive. Inside sat a file named for the trading agent, and at first glance it looked entirely legitimate, because it was. The executable is a genuine, Microsoft-signed program whose only role in the attack is to pass the operating system's reputation check. Windows SmartScreen trusts signed binaries from known publishers, so the file cleared a gate that stops most unsigned downloads. The signing certificate was never forged; it did not need to be.
DLL side-loading, then process hollowing
The deception continues the moment the file runs. When the signed executable launches, it loads a malicious library sitting beside it in the same folder, a technique known as DLL side-loading. Because the loader is a trusted program, the malicious library inherits a degree of trust it would never earn on its own. That library then runs the stealer inside a freshly started, legitimate process, a second trick called process hollowing, which makes the malicious code look like ordinary system activity to anyone glancing at a task list.
The payload, tracked as Needle Stealer, has a narrow and specific job. It hunts for any of seven browser wallet extensions installed on the machine, among them MetaMask, Coinbase Wallet and Phantom. Once it finds one, it terminates the browser, unpacks a malicious copy into the extension's folder, and waits. When the victim next opens the wallet, a familiar unlock screen appears. It is not the extension they installed. The counterfeit version contacts the attacker's command server and hands over whatever password is typed into it, and with the wallet identifier and password together, the attacker controls the funds.
This is why the advice around browser wallets keeps hardening. A recognizable logo, a familiar layout and a working unlock prompt no longer prove that the extension on screen is the one that was installed from the official store. Users are being asked to treat wallet software as something to verify, not simply to recognize, and to keep wallet passwords and payment activity away from agent applications they cannot independently confirm.
Why AI agent installers are such an attractive disguise
The campaign exploits a genuine shift in how people buy software. AI agents are marketed as small, self-contained downloads that run locally on a desktop, which means users have been trained to fetch an executable from a vendor site and grant it broad access to their files, their browser and their accounts. That is precisely the permission set a stealer needs. Trading tools add a second layer of motivation, because anyone running an automated crypto agent already expects the software to interact with a wallet. A request for wallet access, in that context, raises no alarm.
Search advertising makes the approach cheaper still. A malicious listing placed above or beside a legitimate vendor can capture users who are actively shopping, and the resulting download is not a link in an email that a gateway could inspect. It is a file the user chose to retrieve, from a site they found themselves, carrying a signature that the operating system respects.
The QR code that moves the victim to a phone
The same research effort uncovered several campaigns built around PDF invoices. Each attachment showed a blurred document sitting behind a QR code, with instructions telling the recipient to scan the code with a smartphone to view the file. The technique is known as quishing, and its logic is straightforward. A work computer is likely to sit behind an email gateway, a web proxy and a browser that already blocks known phishing domains. A personal phone usually carries far fewer of those defenses.
Scanning the code sends the victim through a chain of redirects. One hop imitates an email security scanner, lending the sequence an air of legitimacy. Another presents a bot-verification challenge of the kind used across the web to confirm that a human is loading the page, which both reassures the visitor and slows automated analysis of the infrastructure. The chain ends on a page styled to resemble a cloud storage service, where the visitor is asked to sign in with corporate credentials. A link a desktop would have stopped can load without complaint on a phone held in the same person's hand.
A stealer sold openly, with updates and a help desk
Another family, Phantom Stealer, is advertised in the open as a penetration testing tool. Buyers receive a crypter that obfuscates the payload against analysis, regular feature updates and round-the-clock support, and they are asked to agree that they will not use the product for malicious purposes. Several email campaigns were observed distributing it.
Steganography and the Phantom Gate component
Each campaign used a VBScript to assemble a PowerShell command. That command fetched an ordinary-looking image from the web and pulled a .NET loader out of it, a steganographic trick that hides executable content inside picture files that pass casual inspection. A component embedded in the PowerShell script, named Phantom Gate, launched the loader, which then downloaded the stealer, decoded it in memory and injected it into RegAsm, a legitimate .NET Framework utility. The shared naming and the shared delivery chain have led researchers to suspect that a single threat actor is behind both the loader and the stealer.
The researchers behind the analysis argue that the pattern reflects a broader problem. People move constantly between devices and applications, from browsers to newly adopted AI tools, and attackers follow that movement rather than fighting the defenses of any single endpoint. Their prescription is a zero-trust model built around isolation and containment, so that an untrusted click or download never becomes an execution path into the rest of the environment.
Hundreds of rigged images across three months
Other invoice campaigns arrived by two routes. Some used HTML smuggling, which assembles the malicious file on the victim's own machine so it never appears as a suspicious attachment for an email gateway to scan. Others relied on search results pointing to lookalike domains. Both routes ended with loaders that decoded payloads hidden inside images and installed XWorm, PureLogs Stealer or Formbook, families that harvest credentials, browser data and system fingerprints.
A perceptual-hash search, which matches images by how they look rather than by exact file data, surfaced roughly 400 distinct images tied to these campaigns over a three-month window. That figure matters because it shows the operation is industrialized. Each image can carry its own payload, each hash differs, and each delivery chain can be rotated without rebuilding the underlying infrastructure.
Fake installers, affiliate payouts and hijacked search
Researchers also traced a Russian-language imitation of a well-known productivity vendor's site. Its installer bundles unrelated products for affiliate payouts and never actually installs the office suite it advertises. In an unintended twist, one of the bundled security products flags the installer as dangerous and deletes it. Two other signed installers, distributed under the names UltraZip and AllFiles, hijack the browser's default search engine and preserve that change even after the user uninstalls the program, turning a one-time download into a lasting source of traffic revenue.
Taken together, the campaigns share a single insight about modern software distribution: the weakest point is rarely the code itself. It is the gap between what a file claims to be and what a user can realistically verify before running it. A signature check, a familiar unlock screen and a smartphone that behaves more permissively than a managed laptop all sit on the attacker's side of that gap.
Source:Help Net Security News