--- url: "https://www.xcademia.com/news/hp-wolf-security-report-reveals-how-attackers-are-weaponizing-ai-brands-qr-codes-and-off-the-shelf-malware" title: "HP Wolf Security Report Reveals How Attackers Are Weaponizing AI Brands, QR Codes and Off-the-Shelf Malware" description: "HP's September 2026 threat report highlights fake AI tools, quishing, malware-as-a-service and evolving malware campaigns seen in Q2 2026." publishedAt: "2026-09-18T10:51:32.22+00:00" updatedAt: "2026-09-18T12:32:12.164891+00:00" type: news category: cybersecurity source_name: HP Wolf Security source_url: "https://threatresearch.ext.hp.com/hp-wolf-security-threat-insights-report-september-2026/" tags: - "#Cybersecurity" - "#Malware" - "#ThreatIntelligence" - "#Phishing" - "#Quishing" - "#InformationStealer" - "#EndpointSecurity" - "#CyberThreats" --- # HP Wolf Security Report Reveals How Attackers Are Weaponizing AI Brands, QR Codes and Off-the-Shelf Malware > HP Wolf Security's September 2026 report highlights Q2 malware campaigns using fake AI tools, QR-code phishing, malware-as-a-service, hidden payloads and familiar software to steal credentials and financial data. Source: **HP Wolf Security** · 18 September 2026 Cybercriminals are continuing to rely on familiar software, trusted brands and everyday workflows to deliver malware, but HP Wolf Security's latest threat intelligence report shows that the techniques used to make those attacks convincing are becoming increasingly varied. The **HP Wolf Security Threat Insights Report: September 2026**, published September 17, examines malware campaigns, phishing activity and attack techniques observed through HP Wolf Security customer telemetry during **calendar Q2 2026**. Among the report's key findings are a fake AI-powered cryptocurrency trading assistant used to distribute Needle Stealer, QR-code phishing campaigns that moved victims from PCs to smartphones, and campaigns involving Phantom Stealer and a related loader called Phantom Gate. The report also documents malicious invoice lures, browser hijacking, fake software installers and continued use of Office macros. Together, the campaigns show how attackers are combining social engineering with legitimate software, scripting tools and modular malware components. ## Fake AI Crypto Assistant Delivers Needle Stealer One of the most notable campaigns described by HP involved a website designed to look like an AI-powered cryptocurrency trading assistant. The site promoted an automated trading bot that supposedly allowed users to define an investment strategy and trade cryptocurrency continuously. HP says the campaign used the name of a well-known AI tool to make the service appear more trustworthy. Instead of receiving a trading assistant, victims were offered a ZIP archive containing malware. The campaign used a legitimate Microsoft-signed executable alongside a malicious DLL. The executable was **OLEView**, a Microsoft-signed program that the report says was used to make the file launched by the victim appear more trustworthy to Windows security controls. The malicious component, `iviewers.dll`, was loaded through standard DLL import resolution. HP classified the technique as **DLL side-loading, T1574.001**. The malware then used process hollowing to execute its payload inside a newly launched legitimate process. The final payload was **Needle Stealer**, an information stealer written in Go. HP found that Needle Stealer focused heavily on browser-based cryptocurrency wallets. The malware checked installed browser extensions against a predefined list of cryptocurrency wallet extension IDs. If a targeted wallet was found, the malware attempted to replace the legitimate extension with an infected version. The replacement extension could then communicate with a command-and-control server and receive instructions from the attacker. Most importantly, when a victim entered wallet credentials into the fake extension, those credentials could be transmitted to the attacker. ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1789728290509-info-1--156-.webp) ## QR Codes Become a Bridge From PC to Smartphone Another campaign identified by HP used a technique known as **quishing**, where attackers use QR codes to direct victims to phishing websites. The campaigns began with emails containing PDF invoices. Instead of displaying a conventional phishing link, the document encouraged the recipient to scan a QR code using a smartphone. The QR code redirected the victim through several stages before reaching the final phishing page. HP says the chain included a QR-code generator, a fake security verification page and a Cloudflare Turnstile challenge before the victim reached the credential-harvesting site. The final destination presented what appeared to be a secure document that required a Microsoft login. The important element was not simply the QR code. It was the change in device. A phishing URL that may already be blocked or monitored on a corporate computer can behave differently when opened on a personal or unmanaged smartphone. By encouraging the victim to move from a protected PC to a phone, attackers can potentially move the interaction outside some of the security controls applied to the original device. HP observed Microsoft credential harvesting at the end of the chain. ### ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1789728305221-info-2--138-.webp) ## Phantom Stealer Shows the Commercialization of Malware HP also investigated campaigns distributing **Phantom Stealer**, which is marketed online as a penetration-testing tool. According to the report, the malware is sold with features associated with malware-as-a-service offerings, including updates and customer support. In the observed campaigns, Phantom Stealer arrived through email attachments containing archive files. The infection chain used a Visual Basic Script to initiate the process. PowerShell then downloaded an image containing hidden malware. The technique is an example of **steganography**, where malicious content is concealed inside an apparently ordinary image. A component called **Phantom Gate** acted as a loader. HP says Phantom Gate extracted a .NET component from the image and executed it through process injection into a legitimate .NET Framework process. The observed target was **RegAsm**. HP also found configurations capable of establishing persistence through Windows `CurrentVersion\Run` registry keys. The researchers believe Phantom Gate and Phantom Stealer may have been created by the same threat actor, based on the shared naming and infection chain. This remains an assessment from HP Threat Research rather than a confirmed attribution. The campaign illustrates another trend identified in the report: attackers can assemble malware campaigns from multiple components rather than developing every part from scratch. ## One Image Can Carry Multiple Malware Families HP identified another group of campaigns using invoices and financial documents as delivery mechanisms. The initial infection method varied. Some campaigns used HTML attachments that appeared to be bank payment confirmations. The HTML used **HTML smuggling** to assemble malicious content on the victim's system. Other campaigns redirected users from search engines to newly registered websites using terms associated with invoices or accounting software. Despite the different entry points, HP found that the subsequent infection chains shared several components. Downloaded archives contained obfuscated scripts. Those scripts decoded and executed PowerShell commands, which downloaded images containing hidden payloads. The image could then be searched for embedded markers, allowing the loader to extract another payload. The resulting malware was ultimately injected into a legitimate Windows process. HP observed several final payloads, including **XWorm, PureLogs Stealer and Formbook**. XWorm additionally provides remote-control capabilities. ### ## Attackers Continue to Hide Behind Familiar Software The report also examines campaigns that sit between suspicious software distribution and clearly malicious activity. One example involved a website imitating Microsoft's official site and advertising an installer for Microsoft Word. The installer presented a familiar setup experience, but HP found that Microsoft Word itself was not installed. Instead, users were presented with additional software and browser extensions through preselected installation options. The report says the operators monetized installations through affiliate programs. Other campaigns targeted users searching for PDF editors and archive utilities. These websites used similar designs and offered installers signed with code-signing certificates. HP observed that some certificates had already been revoked. The installers could also interact with browser profiles and configuration data. Two examples discussed in the report were **UltraZip** and **AllFiles**. Both were presented as useful software while modifying browser settings. UltraZip used keystroke injection against Firefox, while AllFiles modified Chrome settings using forged signatures obtained from a remote server. The changes could remain in place even after the software was uninstalled. The underlying issue is a trust gap. Users often associate a professional-looking website, familiar software name or valid digital signature with legitimate software. The report shows why those signals alone are not sufficient to establish that an application is trustworthy. ## Office Macros Remain Part of the Threat Landscape Despite years of security efforts around malicious Office macros, HP continues to observe campaigns using them. During Q2 2026, HP identified several campaigns involving malicious documents targeting recipients in Central and South America. One campaign targeted car rental companies with reservation and payment-themed messages. The documents used images and warnings designed to persuade recipients to enable content. Once macros were enabled, VBA code launched an infection chain involving `WScript`, `cmd.exe` and `msiexec`. The chain eventually installed **LodaRAT**, a Remote Access Trojan. HP says LodaRAT can provide capabilities including file management, keystroke logging, screenshots, additional malware downloads, system information collection and command-and-control communication. Another campaign used macro-enabled Office documents to distribute **Quasar RAT**, with recipients in Turkey targeted through package-delivery themed messages. The continued appearance of these campaigns shows that older techniques can remain relevant when attackers pair them with convincing social engineering. ## Q2 2026 Threat Delivery Trends HP's telemetry provides a broader view of how malware reached endpoints during Q2 2026. According to the report: - **Executable files accounted for 40%** of malware delivery types, compared with 39% in Q1. - **Archives accounted for 38%.** - PDF threats accounted for **8%**, down from 10% in Q1. - Word threats accounted for **6%**, down from 7%. - Excel threats rose to **6%**, compared with 4% in Q1. - Browser-based threats accounted for **1%**. - Within archive-based threats, RAR represented 32%, ZIP 31%, GZ 7%, TAR 6%, 7Z 4% and Z 3%. - **Email accounted for 56%** of threats caught by HP Sure Click. - Web browser downloads represented **24%**, while other vectors represented 20%. - Of email threats, **10% bypassed one or more email gateway scanners**, compared with 11% in Q1. These figures describe **HP Wolf Security's customer telemetry**, not the entire global threat landscape, and should be interpreted within that scope. The report also notes wider use of Cloudflare Turnstile by threat actors, which HP says can make automated analysis more difficult. ## What the September Report Says About Modern Malware The individual campaigns in the report use different malware families and infection methods, but several patterns connect them. ### Trust is becoming part of the attack surface Attackers are increasingly presenting malware through familiar brands, professional websites, legitimate software names and polished interfaces. The fake AI trading assistant is one example. Fake Microsoft software and cryptocurrency wallet extensions are others. The objective is to make the victim's decision to download or enter credentials feel normal. ### Attack chains are becoming modular The Phantom Stealer campaign demonstrates how different components can be combined into a larger infection chain. A script, loader, steganographic image and final malware payload can each perform a different role. This modular approach can allow attackers to change one component without necessarily rebuilding the entire campaign. ### Security controls are being bypassed through workflow changes The quishing campaign demonstrates this particularly clearly. The attacker does not necessarily need to defeat a security control directly. Instead, the victim can be encouraged to move the interaction from one device to another. That changes the security environment around the attack. ### Old techniques remain useful PowerShell, Office macros, HTML smuggling and process injection are not new techniques. Their continued appearance in HP's Q2 telemetry shows that attackers do not need a novel exploit for every campaign. Existing operating-system functionality and common business workflows can remain useful when combined with effective social engineering. ## ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1789728561711-info-3--128-.webp) ## For Security Teams For enterprises, the report highlights the importance of looking beyond individual malware signatures. Security teams need visibility into how files arrive, what processes they launch, which browser settings they modify and whether legitimate tools are being used as part of a malicious chain. The report also reinforces the value of examining the complete infection sequence rather than treating an executable, archive, image or script as an isolated file. From a defensive perspective, organizations can consider several areas: - Verify software downloads through official publisher channels. - Treat unexpected QR codes in invoices and business documents with caution. - Avoid entering credentials into applications or browser extensions whose origin cannot be verified. - Monitor unusual PowerShell, scripting and process-injection activity. - Review browser extensions and remove those that are not required. - Maintain endpoint and email security controls across the devices employees use for business. - Continue addressing legacy attack techniques such as malicious Office macros. - Use threat intelligence and indicators of compromise to identify related campaigns. HP also recommends keeping its own Wolf Security deployments current and points customers toward its threat intelligence resources and research repository. Those recommendations are specific to HP's security ecosystem. ## The Broader Security Picture The September 2026 report does not point to one single dominant malware technique. Instead, it documents a collection of campaigns that exploit trust at different stages. An AI-branded website can persuade someone to download a malicious installer. A QR code can move a phishing attack from a protected workstation to a smartphone. A fake software installer can abuse a trusted application name. A familiar Office document can convince a recipient to enable macros. The common element is the attempt to make malicious activity look ordinary. The announcement highlights a broader industry shift toward attacks that combine technical evasion with increasingly convincing delivery mechanisms. As more legitimate software, AI tools and digital workflows become part of everyday business activity, distinguishing trusted software from malicious imitations remains an important security challenge. HP's report covers threats observed during Q2 2026, so its findings should be understood as a snapshot of activity seen through HP Wolf Security telemetry rather than a complete measurement of every threat affecting organizations globally. ## Original source https://threatresearch.ext.hp.com/hp-wolf-security-threat-insights-report-september-2026/ ## Tags `#Cybersecurity` · `#Malware` · `#ThreatIntelligence` · `#Phishing` · `#Quishing` · `#InformationStealer` · `#EndpointSecurity` · `#CyberThreats` --- ## About this content This Markdown news article is the citation-grade twin of [HP Wolf Security Report Reveals How Attackers Are Weaponizing AI Brands, QR Codes and Off-the-Shelf Malware](https://www.xcademia.com/news/hp-wolf-security-report-reveals-how-attackers-are-weaponizing-ai-brands-qr-codes-and-off-the-shelf-malware). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/hp-wolf-security-report-reveals-how-attackers-are-weaponizing-ai-brands-qr-codes-and-off-the-shelf-malware - Publisher: Xcademia — https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt