HP reports cyberattacks using AI and cryptocurrency lures

HP Inc. has released its latest Threat Insights Report, analyzing real-world cyberattacks based on data from millions of endpoints using HP Wolf Security. The report highlights several evolving tactics used by cybercriminals to evade detection.

One major threat involves fake AI trading agents. Attackers exploit interest in Agentic AI by advertising fraudulent agents to trick users into installing malware. Once installed, the software scans browsers for cryptocurrency wallet extensions, such as Coinbase and MetaMask, replacing them with malicious imitations to steal credentials and assets.

Additionally, the report notes the continued use of QR code phishing. Attackers send PDF files claiming content is blurred for security, prompting victims to scan a QR code with their mobile devices. This redirects users to phishing sites that may have been blocked on their computers, moving the attack to less secure mobile environments. The report also identifies the expansion of the Phantom Stealer ecosystem through a new malware loader called Phantom Gate.