{"id":563544,"date":"2026-09-18T06:10:30","date_gmt":"2026-09-18T05:10:30","guid":{"rendered":"https:\/\/cryptoslate.com\/?p=563544"},"modified":"2026-09-17T20:04:41","modified_gmt":"2026-09-17T19:04:41","slug":"hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies","status":"publish","type":"post","link":"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/","title":{"rendered":"Fake AI crypto software is secretly replacing browser wallet extensions"},"content":{"rendered":"<p>HP Wolf Security, the company's threat-research team, said a fake AI crypto-trading assistant distributed malware that could replace browser crypto wallet extensions on an infected Windows computer and turn the familiar wallet interface into a credential trap.<\/p>\n<p>The campaign appeared in HP's <a href=\"https:\/\/threatresearch.ext.hp.com\/hp-wolf-security-threat-insights-report-september-2026\/\">September threat report<\/a>, published Sept. 17 and based on threats observed from April through June 2026. HP described a compromise that began on a user's endpoint after a counterfeit <a href=\"https:\/\/cryptoslate.com\/trading\/\">trading tool<\/a> was downloaded and run, not a breach of <a href=\"https:\/\/cryptoslate.com\/companies\/coinbase\/\">Coinbase<\/a>, MetaMask, or their official extensions.<\/p>\n<p>Malwarebytes had <a href=\"https:\/\/www.malwarebytes.com\/blog\/threat-intel\/2026\/04\/malicious-trading-website-drop-malware-that-hands-over-your-browser-to-attackers\">documented the TradingClaw campaign<\/a> in April and found that Needle Stealer also circulated through other malware loaders. The fake AI assistant was one route into a broader malware operation.<\/p>\n\n<div class=\"cs-article-embed\">\n    <a href=\"https:\/\/cryptoslate.com\/hackers-sneak-crypto-wallet-stealing-code-into-a-popular-ai-tool-that-runs-every-time\/\" class=\"cs-article-embed__link\">\n        <div class=\"cs-article-embed__body\">\n            <span class=\"cs-article-embed__related-reading\">Related Reading<\/span>\n            <h3 class=\"cs-article-embed__title\">Hackers sneak crypto wallet-stealing code into a popular AI tool that runs every time<\/h3>\n        <\/div>\n        <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\">\n            <i class=\"fa-light fa-arrow-up-right\"><\/i>\n        <\/span>\n    <\/a>\n<\/div>\n\n<p>Attackers promoted tradingclaw[.]pro as an AI assistant that could follow a personalized strategy and trade around the clock, according to the <a href=\"https:\/\/threatresearch.ext.hp.com\/wp-content\/uploads\/2026\/09\/HP_Wolf_Security_Threat_Insights_Report_September_2026.pdf\">full HP report<\/a>. Search-engine poisoning and paid advertisements directed prospective victims to a ZIP file presented as the software's installer.<\/p>\n<p>The archive contained an executable named Trading Agent.exe and a DLL named iviewers.dll. HP identified the executable as OLEView, <a href=\"https:\/\/cryptoslate.com\/companies\/microsoft\/\">Microsoft's<\/a> legitimate, digitally signed <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/com\/ole-com-object-viewer\">OLE\/COM Object Viewer<\/a>. HP said the signed program helped bypass Microsoft's SmartScreen reputation check, while the malicious payload remained in the accompanying DLL.<\/p>\n<p>Running the trusted-looking program caused it to load that DLL. The code then decrypted Needle Stealer and used process hollowing, a technique that runs malicious code inside a newly launched legitimate process.<\/p>\n<figure id=\"attachment_563555\" aria-describedby=\"caption-attachment-563555\" style=\"width: 720px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-18d695c4-b667-4c7e-875b-6bcd61c3ef77.png\" target=\"_blank\" rel=\"noopener\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-563555\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-18d695c4-b667-4c7e-875b-6bcd61c3ef77.png\" alt=\"Six-step diagram showing how a fake AI trading tool delivered Needle Stealer and replaced browser crypto wallet extensions with credential-stealing copies.\" width=\"720\" height=\"405\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-18d695c4-b667-4c7e-875b-6bcd61c3ef77.png 1672w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-18d695c4-b667-4c7e-875b-6bcd61c3ef77-300x169.png 300w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-18d695c4-b667-4c7e-875b-6bcd61c3ef77-1024x576.png 1024w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-18d695c4-b667-4c7e-875b-6bcd61c3ef77-768x432.png 768w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-18d695c4-b667-4c7e-875b-6bcd61c3ef77-1536x864.png 1536w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-18d695c4-b667-4c7e-875b-6bcd61c3ef77-480x270.png 480w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-18d695c4-b667-4c7e-875b-6bcd61c3ef77-1200x675.png 1200w\" sizes=\"(max-width: 720px) 100vw, 720px\" \/><\/a><figcaption id=\"caption-attachment-563555\" class=\"wp-caption-text\">A fake AI trading tool delivered Needle Stealer through a malicious ZIP, targeting seven wallet extensions and stealing credentials from compromised devices.<\/figcaption><\/figure>\n<h2>How the crypto wallet swap worked<\/h2>\n<p>Needle Stealer enumerated Chromium browser extensions and checked their 32-character IDs against a hardcoded list covering <a href=\"https:\/\/cryptoslate.com\/products\/phantom\/\">Phantom<\/a>, <a href=\"https:\/\/cryptoslate.com\/crypto-wallets\/trust-wallet-review\/\">Trust Wallet<\/a>, Atomic Wallet, <a href=\"https:\/\/cryptoslate.com\/products\/base-app\/\">Coinbase Wallet<\/a>, <a href=\"https:\/\/cryptoslate.com\/products\/okx-wallet\/\">OKX Wallet<\/a>, <a href=\"https:\/\/cryptoslate.com\/products\/metamask\/\">MetaMask<\/a>, and Tonkeeper.<\/p>\n<p>When it found a target, the malware shut down the browser and extracted a corresponding malicious extension into the existing extension folder.<\/p>\n<p>On its first launch, the replacement connected to a command-and-control server used by the attacker and loaded backup domains. HP said the attackers had built realistic login screens, and a crypto wallet ID and password entered into a counterfeit interface could be sent to the operator.<\/p>\n<p><a href=\"https:\/\/support.metamask.io\/start\/user-guide-secret-recovery-phrase-password-and-private-keys\">MetaMask's guidance<\/a> says that, for crypto wallets created with a Secret Recovery Phrase, the password unlocks MetaMask locally and cannot restore the wallet elsewhere. Even so, the substituted extension was operating on an already compromised device, leaving locally accessible funds at risk.<\/p>\n<p>Neither HP's report nor its <a href=\"https:\/\/www.hp.com\/us-en\/newsroom\/press-releases\/2026\/hp-research-cybercriminals-leaning-into-agentic-ai-momentum-to-steal-crypto-wallets.html\">newsroom summary<\/a> disclosed a campaign-wide victim count or aggregate crypto-loss figure, leaving the operation's scale unknown.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Needle Stealer used signed Microsoft software to target seven browser wallets without breaching Coinbase or MetaMask.<\/p>\n","protected":false},"author":1264,"featured_media":563564,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[35,77968,16041,6849,60206],"tags":[81114,77540,77461],"prediction_market_topic":[],"post_folder":[],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v21.9 (Yoast SEO v21.9.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Fake AI crypto software is secretly replacing browser wallet extensions<\/title>\n<meta name=\"description\" content=\"Needle Stealer used signed Microsoft software to target seven browser crypto wallets without breaching Coinbase or MetaMask.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Fake AI crypto software is secretly replacing browser wallet extensions\" \/>\n<meta property=\"og:description\" content=\"Needle Stealer used signed Microsoft software to target seven browser crypto wallets without breaching Coinbase or MetaMask.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/\" \/>\n<meta property=\"og:site_name\" content=\"CryptoSlate\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-18T05:10:30+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-17T19:04:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/extension-swap-board.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Liam &#039;Akiba&#039; Wright\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@akibablade\" \/>\n<meta name=\"twitter:site\" content=\"@cryptoslate\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Liam 'Akiba' Wright\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/\"},\"author\":{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/#person\",\"name\":\"Liam 'Akiba' Wright\",\"url\":\"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/\"},\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/#authorimage\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-300x300.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-300x300.jpg\",\"caption\":\"Liam 'Akiba' Wright\"},\"jobTitle\":\"Editor-in-Chief\",\"description\":\"Liam \u201cAkiba\u201d Wright is CryptoSlate\u2019s Editor-in-Chief, reporter and podcast producer, focused on decentralized tech\u2019s positive impact.\",\"worksFor\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"sameAs\":[\"https:\/\/www.akiba.gg\",\"https:\/\/x.com\/akibablade\",\"https:\/\/www.linkedin.com\/in\/liamandrewwright\",\"https:\/\/muckrack.com\/liam-wright\"]},\"headline\":\"Fake AI crypto software is secretly replacing browser wallet extensions\",\"datePublished\":\"2026-09-18T05:10:30+00:00\",\"dateModified\":\"2026-09-18T05:10:30+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/\"},\"wordCount\":460,\"publisher\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"keywords\":[\"AI\",\"Coinbase Wallet\",\"MetaMask\"],\"articleSection\":[\"Adoption\",\"Featured\",\"Hacks\",\"Trading\",\"Wallets\"],\"inLanguage\":\"en-US\",\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/\",\"url\":\"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/\",\"name\":\"Fake AI crypto software is secretly replacing browser wallet extensions\",\"isPartOf\":{\"@id\":\"https:\/\/cryptoslate.com\/#website\"},\"datePublished\":\"2026-09-18T05:10:30+00:00\",\"dateModified\":\"2026-09-18T05:10:30+00:00\",\"description\":\"Needle Stealer used signed Microsoft software to target seven browser crypto wallets without breaching Coinbase or MetaMask.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptoslate.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Fake AI crypto software is secretly replacing browser wallet extensions\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptoslate.com\/#website\",\"url\":\"https:\/\/cryptoslate.com\/\",\"name\":\"CryptoSlate\",\"description\":\"Cryptocurrency News and Real-time Coin Data\",\"publisher\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"inLanguage\":\"en-US\"},{\"@type\":\"NewsMediaOrganization\",\"@id\":\"https:\/\/cryptoslate.com\/#organization\",\"name\":\"CryptoSlate\",\"url\":\"https:\/\/cryptoslate.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg\",\"width\":1000,\"height\":1000,\"caption\":\"CryptoSlate\"},\"image\":{\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/twitter.com\/cryptoslate\",\"https:\/\/www.instagram.com\/cryptoslate\",\"https:\/\/www.linkedin.com\/company\/cryptoslate\",\"https:\/\/www.youtube.com\/c\/cryptoslate\",\"https:\/\/t.me\/cryptoslatenews\",\"https:\/\/www.crunchbase.com\/organization\/cryptoslate\",\"https:\/\/iq.wiki\/wiki\/cryptoslate\",\"https:\/\/news.google.com\/publications\/CAAqKggKIiRDQklTRlFnTWFoRUtEMk55ZVhCMGIzTnNZWFJsTG1OdmJTZ0FQAQ\",\"https:\/\/muckrack.com\/media-outlet\/cryptoslate\",\"https:\/\/www.tiktok.com\/@cryptoslatenews\"],\"publishingPrinciples\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles\",\"ownershipFundingInfo\":\"https:\/\/cryptoslate.com\/disclaimers\/how-cryptoslate-makes-and-spends-money\/\",\"correctionsPolicy\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback\",\"ethicsPolicy\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles\",\"foundingDate\":\"2017-08-04\",\"founder\":[{\"@type\":\"Person\",\"name\":\"Nate Whitehill\"},{\"@type\":\"Person\",\"name\":\"Matthew Blancarte\"}],\"contactPoint\":[{\"@type\":\"ContactPoint\",\"contactType\":\"customer support\",\"url\":\"https:\/\/cryptoslate.com\/contact\/\",\"availableLanguage\":\"en-US\"},{\"@type\":\"ContactPoint\",\"contactType\":\"sales\",\"url\":\"https:\/\/cryptoslate.com\/contact\/?topic=advertising#contact-form\",\"availableLanguage\":\"en-US\"},{\"@type\":\"ContactPoint\",\"contactType\":\"newsroom\",\"url\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback\",\"email\":\"tips@cryptoslate.com\",\"availableLanguage\":\"en-US\"}],\"masthead\":\"https:\/\/cryptoslate.com\/about\/#masthead\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/ea2b02b41a7478e18d903ca8eec4979e\",\"name\":\"Liam 'Akiba' Wright\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-150x150.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-150x150.jpg\",\"caption\":\"Liam 'Akiba' Wright\"},\"description\":\"Also known as \\\"Akiba,\\\" Liam Wright is the Editor-in-Chief at CryptoSlate and host of the SlateCast. He believes that together decentralized blockchain and AI technology have the potential to make widespread positive change.\",\"sameAs\":[\"https:\/\/www.akiba.gg\",\"https:\/\/www.instagram.com\/akibablade\",\"https:\/\/twitter.com\/akibablade\"],\"award\":[\"Most improved footballer - 1992\"],\"knowsAbout\":[\"Python\",\"Javascript\",\"PHP\",\"HTML\",\"Agentic Software\",\"Machine Learning\",\"2000s emo music\",\"Manchester United\"],\"knowsLanguage\":[\"English\",\"Spanish\"],\"url\":\"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Fake AI crypto software is secretly replacing browser wallet extensions","description":"Needle Stealer used signed Microsoft software to target seven browser crypto wallets without breaching Coinbase or MetaMask.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/","og_locale":"en_US","og_type":"article","og_title":"Fake AI crypto software is secretly replacing browser wallet extensions","og_description":"Needle Stealer used signed Microsoft software to target seven browser crypto wallets without breaching Coinbase or MetaMask.","og_url":"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/","og_site_name":"CryptoSlate","article_published_time":"2026-09-18T05:10:30+00:00","article_modified_time":"2026-09-17T19:04:41+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/extension-swap-board.webp","type":"image\/webp"}],"author":"Liam 'Akiba' Wright","twitter_card":"summary_large_image","twitter_creator":"@akibablade","twitter_site":"@cryptoslate","twitter_misc":{"Written by":"Liam 'Akiba' Wright","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/#article","isPartOf":{"@id":"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/"},"author":{"@type":"Person","@id":"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/#person","name":"Liam 'Akiba' Wright","url":"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/","mainEntityOfPage":{"@id":"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/"},"image":{"@type":"ImageObject","@id":"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/#authorimage","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-300x300.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-300x300.jpg","caption":"Liam 'Akiba' Wright"},"jobTitle":"Editor-in-Chief","description":"Liam \u201cAkiba\u201d Wright is CryptoSlate\u2019s Editor-in-Chief, reporter and podcast producer, focused on decentralized tech\u2019s positive impact.","worksFor":{"@id":"https:\/\/cryptoslate.com\/#organization"},"sameAs":["https:\/\/www.akiba.gg","https:\/\/x.com\/akibablade","https:\/\/www.linkedin.com\/in\/liamandrewwright","https:\/\/muckrack.com\/liam-wright"]},"headline":"Fake AI crypto software is secretly replacing browser wallet extensions","datePublished":"2026-09-18T05:10:30+00:00","dateModified":"2026-09-18T05:10:30+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/"},"wordCount":460,"publisher":{"@id":"https:\/\/cryptoslate.com\/#organization"},"keywords":["AI","Coinbase Wallet","MetaMask"],"articleSection":["Adoption","Featured","Hacks","Trading","Wallets"],"inLanguage":"en-US","copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/cryptoslate.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/","url":"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/","name":"Fake AI crypto software is secretly replacing browser wallet extensions","isPartOf":{"@id":"https:\/\/cryptoslate.com\/#website"},"datePublished":"2026-09-18T05:10:30+00:00","dateModified":"2026-09-18T05:10:30+00:00","description":"Needle Stealer used signed Microsoft software to target seven browser crypto wallets without breaching Coinbase or MetaMask.","breadcrumb":{"@id":"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptoslate.com\/"},{"@type":"ListItem","position":2,"name":"Fake AI crypto software is secretly replacing browser wallet extensions"}]},{"@type":"WebSite","@id":"https:\/\/cryptoslate.com\/#website","url":"https:\/\/cryptoslate.com\/","name":"CryptoSlate","description":"Cryptocurrency News and Real-time Coin Data","publisher":{"@id":"https:\/\/cryptoslate.com\/#organization"},"inLanguage":"en-US"},{"@type":"NewsMediaOrganization","@id":"https:\/\/cryptoslate.com\/#organization","name":"CryptoSlate","url":"https:\/\/cryptoslate.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg","width":1000,"height":1000,"caption":"CryptoSlate"},"image":{"@id":"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/twitter.com\/cryptoslate","https:\/\/www.instagram.com\/cryptoslate","https:\/\/www.linkedin.com\/company\/cryptoslate","https:\/\/www.youtube.com\/c\/cryptoslate","https:\/\/t.me\/cryptoslatenews","https:\/\/www.crunchbase.com\/organization\/cryptoslate","https:\/\/iq.wiki\/wiki\/cryptoslate","https:\/\/news.google.com\/publications\/CAAqKggKIiRDQklTRlFnTWFoRUtEMk55ZVhCMGIzTnNZWFJsTG1OdmJTZ0FQAQ","https:\/\/muckrack.com\/media-outlet\/cryptoslate","https:\/\/www.tiktok.com\/@cryptoslatenews"],"publishingPrinciples":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles","ownershipFundingInfo":"https:\/\/cryptoslate.com\/disclaimers\/how-cryptoslate-makes-and-spends-money\/","correctionsPolicy":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback","ethicsPolicy":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles","foundingDate":"2017-08-04","founder":[{"@type":"Person","name":"Nate Whitehill"},{"@type":"Person","name":"Matthew Blancarte"}],"contactPoint":[{"@type":"ContactPoint","contactType":"customer support","url":"https:\/\/cryptoslate.com\/contact\/","availableLanguage":"en-US"},{"@type":"ContactPoint","contactType":"sales","url":"https:\/\/cryptoslate.com\/contact\/?topic=advertising#contact-form","availableLanguage":"en-US"},{"@type":"ContactPoint","contactType":"newsroom","url":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback","email":"tips@cryptoslate.com","availableLanguage":"en-US"}],"masthead":"https:\/\/cryptoslate.com\/about\/#masthead"},{"@type":"Person","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/ea2b02b41a7478e18d903ca8eec4979e","name":"Liam 'Akiba' Wright","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/image\/","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-150x150.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-liam-akiba-wright-150x150.jpg","caption":"Liam 'Akiba' Wright"},"description":"Also known as \"Akiba,\" Liam Wright is the Editor-in-Chief at CryptoSlate and host of the SlateCast. He believes that together decentralized blockchain and AI technology have the potential to make widespread positive change.","sameAs":["https:\/\/www.akiba.gg","https:\/\/www.instagram.com\/akibablade","https:\/\/twitter.com\/akibablade"],"award":["Most improved footballer - 1992"],"knowsAbout":["Python","Javascript","PHP","HTML","Agentic Software","Machine Learning","2000s emo music","Manchester United"],"knowsLanguage":["English","Spanish"],"url":"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/"}]}},"_links":{"self":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/563544"}],"collection":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/users\/1264"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/comments?post=563544"}],"version-history":[{"count":3,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/563544\/revisions"}],"predecessor-version":[{"id":563575,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/563544\/revisions\/563575"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/media\/563564"}],"wp:attachment":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/media?parent=563544"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/categories?post=563544"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/tags?post=563544"},{"taxonomy":"prediction_market_topic","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/prediction_market_topic?post=563544"},{"taxonomy":"post_folder","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/post_folder?post=563544"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}