AI malware campaign replaces users' crypto wallets

TLDR

Recent research shows a sophisticated malware campaign using AI-themed tools and hijacked accounts to replace users crypto wallets and steal funds.

1. A fake AI trading assistant delivered malware that removed real browser wallet extensions and installed lookalike credential?stealing versions.
2. Parallel campaigns hijacked trusted brands and used crypto clippers and counterfeit wallet apps to silently redirect payments or harvest recovery phrases.
3. The broader trend is AI making both malware generation and security scanning more powerful, so users need stricter download, device, and wallet hygiene.

Deep Dive

1. How Wallet-Replacing Malware Works

HP Wolf Security documented a scam where victims downloaded a fake AI crypto trading bot from tradingclaw[.]pro, analyzed by CryptoSlate as Needle Stealer malware, which targeted Chromium-based browser wallets including MetaMask, Phantom, Atomic Wallet, OKX Wallet, Base App, Bitget, and Tonkeeper.Fake AI trading bot report

Victims ran a Microsoft-signed Trading Agent.exe plus a malicious DLL that decrypted Needle Stealer, which then closed the browser, deleted legitimate wallet extensions, and installed realistic-looking replacements connected to attacker servers.

When users typed passwords or seed phrases into these fake wallets, the credentials were sent to the attackers, allowing full control over funds, even though no official wallet provider was breached.

2. Other AI-Driven Wallet Attacks

Hudson Rock and ADAMnetworks traced the PasteSwitch campaign, where hackers hijacked HBO Maxs verified Reddit account to run 108 malicious ads in 48 hours, including AI-coding lures that installed information stealers, crypto clippers, and counterfeit wallet apps targeting recovery phrases.HBO Max Reddit malware ads

Chainalysis reports a roughly 440% surge in malicious blockchain dead drop writes since mid?2025, coinciding with powerful open?source AI models that can generate malicious code, and tying much of this activity to state-linked actors from North Korea and Iran.Onchain malware surge

Together, these show attackers using AI as both lure (fake AI tools, deepfaked streams) and engine (fast code generation, on-chain command and control) focused on credentials and wallet traffic.

3. Practical Defenses And What To Watch

1. Only install wallets and trading tools from official sites or vetted app stores; avoid downloads from ads, search results, or AI assistant landing pages.
2. Treat any request for seed phrases or private keys inside browser extensions, bots, or web apps as a red flag, and keep larger balances in hardware wallets.
3. Keep browsers, extensions, and endpoint protection up to date; watch for sudden extension removal, strange prompts, or copied addresses changing at paste time.

Confidence: high, based on multiple independent security reports.

Conclusion

AI malware campaigns are increasingly designed to look like legitimate trading tools and wallet interfaces, making endpoint compromise the main threat for crypto users. The same AI advances are also being deployed by defenders to scan code and infrastructure, so the balance will depend on how quickly users and platforms adopt stricter download practices, hardware custody, and AI-assisted security review.