HP Threat Insights report reveals AI trading scams and QR phishing tactics

HP Threat Insights report exposes how hackers are chasing AI trading hype and crypto wallets

Cybercriminals rarely invent new tricks from scratch. They watch what people are excited about and build traps around it. The latest HP Threat Insights report shows this pattern clearly. Between April and June 2026, HP Wolf Security researchers tracked real attacks hitting millions of endpoints, and the findings paint a picture of criminals moving fast to exploit trends like agentic AI, while sticking to old reliable tactics like QR code phishing.

If you run a business, manage IT security, or just want to understand where the next scam might come from, this report is worth unpacking in plain terms.

Fake AI trading agents are the new bait for crypto theft

One of the most notable findings in the HP Threat Insights report is how attackers are cashing in on the excitement around agentic AI. Instead of building something useful, criminals are advertising fake AI trading agents designed to do one thing: get installed on your computer.

Once a victim downloads this fake tool, the malware quietly scans the browser for crypto wallet extensions such as Coinbase and MetaMask. It then swaps these real extensions with malicious lookalikes. From the outside, everything looks normal. But the moment a victim types in their wallet credentials, those details go straight to the attacker.

This is a good example of how crypto malware has evolved. It no longer relies on obvious phishing emails alone. It rides on trending topics, in this case the rush toward AI-powered tools, to lower people’s guard. Patrick Schläpfer, Principal Threat Researcher at HP Security Lab, pointed out that attackers are using this AI adoption wave to make malware delivery look more polished and harder to catch.

The lesson here is simple. Any tool promising automated trading gains, especially one you have not verified through an official source, deserves a second look before installation.

QR phishing keeps moving credential theft to your phone

While AI-themed scams are new, QR phishing is a tactic that keeps working because it exploits a gap most people do not think about: the difference in protection between a work computer and a personal phone.

The HP Threat Insights report describes a common version of this attack. Victims receive a PDF file that claims its content is “blurred for security.” To view it, they are told to scan a QR code with their phone. That code redirects them to a phishing site, often one that would have been blocked if opened on the original PC.

This matters because most organizations invest heavily in securing laptops and desktops with firewalls, endpoint protection, and email filters. Phones used for personal browsing frequently do not have the same layer of defense. By nudging the victim to switch devices mid-attack, criminals sidestep the very protections companies pay for.

If your organization allows QR code scanning as part of any workflow, it is worth training staff to pause and question why a legitimate document would ever ask them to switch devices to view it.

Phantom Gate shows how malware is becoming a modular business

Perhaps the most telling discovery in the report is something called Phantom Gate, a newly identified malware loader. On its own, a loader is not flashy. Its job is simply to open the door for other malicious payloads. But what makes Phantom Gate worth paying attention to is what it connects to.

Researchers found Phantom Gate extending an existing operation known as Phantom Stealer. What makes this campaign unusual is that Phantom Stealer is openly marketed and sold as legitimate penetration testing software. In other words, a tool built with a defensible, even legal, use case is being repurposed and combined with a new loader mechanism to make attacks easier to build and scale.

This reflects a broader shift in how cybercrime operates today. It increasingly resembles a supply chain, where different groups build specialized components and combine them, much like legitimate software vendors build modular products. James Wright, HP’s Global Head of Security for Personal Systems, described this as attackers following users across every device and application they touch, from browsers to new AI tools.

The bigger picture: attackers are diversifying delivery methods

Beyond individual campaigns, the HP Threat Insights report highlights how threats are getting past traditional defenses. At least 10 percent of email threats identified by HP Sure Click managed to bypass one or more email gateway scanners during the reporting period.

The report also breaks down how malware most often reaches victims:

1. Executable files: 40 percent of malware delivery
2. Archive files: 38 percent of malware delivery
3. PDF documents: 7.5 percent of malware delivery

This spread tells us something important. Attackers are not relying on a single file type or a single trick. They are testing multiple formats and multiple stories, from fake AI apps to disguised PDFs, to see what gets past filters and past human suspicion.

Why zero trust security matters more than ever

The common thread across every finding in this report is that traditional detection alone is not enough anymore. Whether it is a fake AI trading tool, a QR code redirect, or a modular malware loader like Phantom Gate, these attacks are designed specifically to slip past scanners and filters.

This is exactly why zero trust security built around isolation and containment is gaining ground. Instead of trying to predict and block every new attack signature, isolation technology assumes any click or download could be risky and contains it in a safe environment before it can cause damage.

HP Wolf Security, for instance, notes that its customers have clicked on 60 billion email attachments, web pages, and downloaded files during the reporting period with no reported breaches, largely because risky content is detonated safely inside secure containers rather than directly on the device.

For organizations building a security strategy for the rest of 2026 and beyond, the takeaway is straightforward. Assume that some malicious content will get through your filters. Build your defenses around containment and isolation, not just detection, so that a single wrong click does not turn into a full compromise.

TLDR

1. Attackers are exploiting agentic AI hype through fake trading tools that hijack crypto wallet extensions
2. QR phishing continues to move credential theft from protected PCs to less protected phones
3. Phantom Gate shows how malware components are becoming modular and easier to combine
4. At least 10 percent of email threats bypassed one or more email gateway scanners
5. Executable files remain the top malware delivery method at 40 percent
6. A zero trust security approach with isolation and containment reduces the impact of threats that get past initial defenses

Cybercrime is not static, and reports like this one are a reminder that today’s biggest tech trends, whether it is agentic AI or crypto trading, will always attract attackers looking for a new angle. Staying informed about these shifts is one of the simplest ways to stay a step ahead.