Fake AI Crypto Trading Agent Targets Wallet Passwords
A fake AI trading-agent campaign has targeted MetaMask, Coinbase Wallet and Phantom users with wallet-stealing malware.
Crypto Support & Research Desk
Security researchers documented a fake AI crypto trading agent that distributed Needle Stealer malware. The campaign targeted browser-wallet users, including MetaMask, Coinbase Wallet and Phantom, by replacing or tampering with wallet components and stealing credentials.
How the attack works
The lure is software promising automated AI crypto trading. Researchers observed malicious distribution through search results or ads, plus QR-code phishing that moved victims between desktop and mobile. The danger begins before any on-chain transaction: installing untrusted software can compromise wallet credentials.
What to do if you installed suspicious trading software
Disconnect the device from sensitive accounts, use a clean device to create a new wallet, and move assets only after verifying the new wallet software from an official source. Rotate exchange passwords and API keys that may have been exposed. Do not reuse a compromised recovery phrase.
How to avoid similar scams
Do not install trading agents from advertisements or cloned websites. Verify software publishers, URLs and extension IDs. Treat claims of guaranteed autonomous profit as a warning sign, and keep high-value wallets separate from experimental software.
Official source
https://www.helpnetsecurity.com/2026/09/17/fake-ai-trading-agent-research/
Regulatory & Financial Risk Disclosure
The opinions, research, and analysis expressed in this publication are solely for educational and informational purposes and do not constitute investment, financial, legal, or tax advice. Digital asset markets are speculative and volatile. Past performance does not indicate future results. Always perform independent due diligence.
About the Author
Crypto Support & Research Desk
Crypto Support Desk publishes practical, source-led guides to exchange, wallet, network and on-chain service changes. Information is checked against primary or reputable security sources and is not investment advice.