Check Pointstcpresearch
Rust clipboard hijacker steals crypto through fake GitHub apps
Part of the clipboard story · since 17 Jun
- Wed 17 Jun, 13:48 UTC. Check Point, first report. Rust clipboard hijacker steals crypto through fake GitHub apps. This article, 1st of 7.
- Thu 18 Jun, 00:47 UTC. Microsoft, its first report on the story. Windows crypto clipper malware hijacks clipboard via Tor.
- Thu 18 Jun, 15:07 UTC. Infosecurity, its first report on the story. Fake GitHub stars drive crypto clipboard hijacker malware.
- Thu 18 Jun, 19:00 UTC. Security Affairs, its first report on the story. Tor based clipboard malware steals crypto via USB shortcuts.
- Fri 19 Jun, 00:05 UTC. Ars Technica, its first report on the story. New USB Spread Crypto Clipper malware hijacks wallets via Tor.
- Mon 22 Jun, 16:50 UTC. Dark Reading, its first report on the story. Fake reputation scam spreads clipboard hijacker to steal crypto.
- Wed 24 Jun, 09:30 UTC. SecurityOnline, its first report on the story. Crypto Clipboard Hijacker Hides Behind Fake Stars and Upvotes.
The report discusses a sophisticated campaign involving a Rust-based clipboard hijacker that targets cryptocurrency users. The campaign employs various deceptive tactics to create a false sense of legitimacy, including fake engagement through GitHub, SourceForge, and YouTube, along with manipulated comments on VirusTotal. A phishing site acts as the central hub, promoting tools that promise unfair advantages in crypto trading.
Tools are distributed across multiple platforms while the threat actor uses Ghost Networks of fake accounts to create the illusion of popularity. These tools primarily target cryptocurrency wallet addresses on the clipboard, replacing them with the actor's own wallet addresses, leading to financial theft. The report highlights the importance of reputation manipulation in modern cyber threats, emphasizing that attackers adapt tactics from social engineering to exploit trust within technology.
How the story developed
7 articles from 7 outlets since 17 Jun. Quiet since 24 Jun. This was the first report.
- Wed 17 Jun, 13:48 UTC. Check Point, first report. Rust clipboard hijacker steals crypto through fake GitHub apps. This article, 1st of 7.
- Thu 18 Jun, 00:47 UTC. Microsoft, its first report on the story. Windows crypto clipper malware hijacks clipboard via Tor.
- Thu 18 Jun, 15:07 UTC. Infosecurity, its first report on the story. Fake GitHub stars drive crypto clipboard hijacker malware.
- Thu 18 Jun, 19:00 UTC. Security Affairs, its first report on the story. Tor based clipboard malware steals crypto via USB shortcuts.
- Fri 19 Jun, 00:05 UTC. Ars Technica, its first report on the story. New USB Spread Crypto Clipper malware hijacks wallets via Tor.
- Mon 22 Jun, 16:50 UTC. Dark Reading, its first report on the story. Fake reputation scam spreads clipboard hijacker to steal crypto.
- Wed 24 Jun, 09:30 UTC. SecurityOnline, its first report on the story. Crypto Clipboard Hijacker Hides Behind Fake Stars and Upvotes.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 7 articles as a listHide the list
- Wed 17 JunDay 01
- Rust clipboard hijacker steals crypto through fake GitHub apps13:48 · Check Point · First report · This article, 1st of 7
- Thu 18 JunDay 13
- Windows crypto clipper malware hijacks clipboard via Tor00:47 · Microsoft
- Fake GitHub stars drive crypto clipboard hijacker malware15:07 · Infosecurity
- Tor based clipboard malware steals crypto via USB shortcuts19:00 · Security Affairs
- Fri 19 JunDay 21
- New USB Spread Crypto Clipper malware hijacks wallets via Tor00:05 · Ars Technica
Quiet for 4 days
Mon 22 JunDay 51- Fake reputation scam spreads clipboard hijacker to steal crypto16:50 · Dark Reading · Picked up again
Quiet for 2 days
Wed 24 JunDay 71- Crypto Clipboard Hijacker Hides Behind Fake Stars and Upvotes09:30 · SecurityOnline