# Malware Posing as an AI Trading Agent Replaces Browser Wallets With Password-Stealing Copies

HP researchers found a Microsoft-signed installer side-loading Needle Stealer against seven wallet extensions, while Cardano's developer warned that its own YouTube channel was hijacked for a fake giveaway.

- Published: 2026-09-18T05:52:43.927Z
- Canonical: https://polylog.news/crypto/2026-09-18/malware-posing-as-an-ai-trading-agent-replaces-browser-walle
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CryptoSlate](https://cryptoslate.com/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies/), [crypto.news](https://crypto.news/cardano-iog-warns-users-after-youtube-channel-hijack/)

Researchers at HP documented a campaign that built a website for a fake artificial-intelligence crypto trading agent and used it to distribute malware called Needle Stealer, CryptoSlate reported. The delivery chain is the notable part. The…

This story is for subscribers. Read it in full at https://polylog.news/crypto/2026-09-18/malware-posing-as-an-ai-trading-agent-replaces-browser-walle (subscription information: https://polylog.news/pricing).