Needle Stealer clears SmartScreen by shipping a Microsoft-signed OLEView copy in the ZIP

SmartScreen's reputation check asks whether a file has been seen and trusted before. A Microsoft-signed utility answers yes, and HP says getting past that check is the executable's only job in this download ^[3]. The malicious code sits next to it in iviewers.dll, which the signed program loads when it runs ^[4]. Any control that decides on the signature or the reputation of the executable clears this ZIP ^[25].

The DLL then starts a fresh legitimate process and runs Needle Stealer inside it, a technique called process hollowing ^[5]. Needle looks for any of seven wallet extensions, among them MetaMask, Coinbase Wallet and Phantom ^[7], kills the browser, and unpacks its own copy into the extension's folder ^[6]. The unlock screen the victim sees after that looks like the one they installed ^[23]. With the wallet ID and the password, the attacker controls the funds ^[8]. The researchers advise keeping wallet passwords and payment work out of agent apps that cannot be verified ^[9].

The QR campaigns move the victim off the managed device. Scanning the code runs through redirects, including a fake email security scanner and a Cloudflare Turnstile check that confirms a person is loading the page, then onto a page resembling OneDrive that asks for Microsoft credentials ^[12]. A work PC has the email gateway and the browser protections; a phone usually carries fewer, so a link the desktop would stop opens ^[13].

Phantom Stealer's sellers require buyers to agree not to use it for malicious purposes ^[14]. In HP's samples, a VBScript built a PowerShell command that fetched an ordinary-looking image and pulled a .NET loader out of it. A component called Phantom Gate started that loader, which downloaded the stealer, decoded it and injected it into RegAsm, a legitimate .NET Framework process ^[16]. HP's researchers assess that one threat actor is behind both tools, on the strength of the shared name and delivery chain ^[17].

A perceptual-hash search of VirusTotal, which matches images by how they look, turned up about 400 distinct images tied to these campaigns over three months ^[18], roughly 133 a month ^[19]. Other invoice runs used HTML smuggling, which assembles the malicious file on the victim's machine so it can slip past email gateway scanners, or search results leading to lookalike domains; both routes ended with loaders that decoded payloads hidden in images and installed XWorm, PureLogs Stealer or Formbook ^[20].

HP also traced a Russian-language imitation of Microsoft's site whose installer bundles other products for affiliate payouts and never installs Word, and the security product it bundles then flags that installer as dangerous and deletes it ^[22].

"Users move constantly between devices and applications, like browsers or new AI tools, and attackers are quick to follow," said James Wright, HP's Global Head of Security for Personal Systems ^[21]. HP's published account of the Needle campaign does not include victim counts, losses or a named actor ^[24].