project

Phantom

Self-custody crypto wallet browser extension, originally built for Solana and later extended to other chains.

Current clusters

Needle Stealer clears SmartScreen by shipping a Microsoft-signed OLEView copy in the ZIP

HP tracked the campaign from April to June 2026, in which a fake AI crypto trading agent shipped a genuine Microsoft utility to satisfy Windows reputation checks before the DLL loaded beside it stole browser wallet passwords.

Publishers:helpnetsecurity.com

Reality

Evidence60
Adoption40
Hype gap+15
Incentives70
Confidence55