HP warns of AI-driven cryptocurrency theft and QR code phishing

HP's latest Threat Insights Report, based on telemetry from millions of HP Wolf Security devices, warns of evolving cyberattack techniques targeting cryptocurrency users and corporate credentials.

One major campaign involves fake AI-powered cryptocurrency trading agents. Attackers use the growing interest in agentic AI to trick users into downloading malware. Once installed, the malware scans browsers for extensions like Coinbase or MetaMask and replaces them with malicious versions to steal login credentials and access funds.

Additionally, attackers are utilizing 'quishing'—phishing via QR codes. By sending PDF documents with content supposedly 'blurred for security reasons,' criminals prompt victims to scan a QR code with their mobile phones. This moves the target from a protected PC to a mobile device with weaker security, redirecting them to phishing sites that might otherwise be blocked on a computer.

Finally, the report highlights the expansion of the Phantom Stealer ecosystem through a new malware loader called Phantom Gate. This tool helps attackers scale campaigns using Phantom Stealer, which is often deceptively marketed as legitimate penetration testing software.