AI trading scam hijacks browser crypto wallets

TLDR

A fake AI crypto trading tool is installing malware that swaps browser wallet extensions for credential stealing clones on Windows PCs, threatening users funds.

1. Criminals promoted a bogus AI trading assistant called TradingClaw that installed Needle Stealer malware, which replaced extensions like MetaMask and Phantom with fake lookalikes.
2. The attack hit multiple popular browser wallets via Chromium extensions, but did not hack the wallets official infrastructure, and the number of victims and total losses remain unknown.
3. You can reduce risk by avoiding AI trading bots from ads, installing wallets only from official stores, and keeping larger balances in hardware wallets or segregated browser profiles.

Deep Dive

1. How The Attack Works

HP Wolf Security reported that a fake AI trading assistant branded TradingClaw, hosted at tradingclaw[.]pro, lured users with promises of an always on crypto trading agent. The download delivered a Windows ZIP containing a legitimate Microsoft signed executable and a malicious DLL, which together installed the Needle Stealer malware on victims PCs.

According to HPs September threat report, Needle Stealer scanned Chromium browser extensions and, when it detected targets such as MetaMask, Coinbase Wallet, Phantom, Trust Wallet, OKX Wallet, Atomic Wallet and Tonkeeper, it shut the browser, deleted the real extension and dropped a malicious replacement. These fake extensions showed convincing wallet interfaces but sent passwords and other credentials to attacker controlled servers instead of securing accounts, as detailed by CryptoSlates coverage.

Importantly, the scam compromised users local machines after they installed the fake tool. There is no evidence that official wallet stores or back ends like MetaMasks infrastructure were breached.

2. Who Is At Risk And Why

Anyone running browser based wallets on Windows and downloading AI trading tools from search results, ads or social links is in scope for this type of attack. The campaign targeted multiple ecosystems via extensions, not a single blockchain.

HP has not published victim counts or total losses, so the full impact is unclear, but similar AI themed scams have already drained hundreds of ETH from victims who followed AI arbitrage bot tutorials and deployed malicious contracts themselves, according to TRM Labs analysis.

3. Practical Defenses For Browser Wallets

You can cut the attack surface significantly with a few habits:

1. Install wallets and trading tools only from official app stores, extension stores, or clearly verified project sites, and avoid downloads linked from ads or random tutorials.
2. Treat AI trading bots and guaranteed arbitrage offers as high risk by default, especially when they require installing desktop software or copying commands into Terminal or PowerShell.
3. Keep substantial balances in hardware wallets, and use a separate browser or profile with minimal extensions for exploratory DeFi or meme coin activity.

Wallet providers are also adding protections. MetaMask, for example, has rolled out Blockaid powered scam prompts and an Added Protection feature that can revert transactions whose final result does not match the preview, as described in its recent security update.

Conclusion

The AI trading scam described here does not break blockchains or official wallet infrastructure. It exploits trust in new AI tools and familiar browser extensions to steal credentials on compromised PCs. The key defenses are behavioral and architectural: favor official distribution channels, isolate high risk activity from primary wallets, and be skeptical of any AI trading offer that begins with a download.