Infosecurity
Fake GitHub stars drive crypto clipboard hijacker malware
Part of the clipboard story · since 17 Jun
- Wed 17 Jun, 13:48 UTC. Check Point, first report. Rust clipboard hijacker steals crypto through fake GitHub apps.
- Thu 18 Jun, 00:47 UTC. Microsoft, its first report on the story. Windows crypto clipper malware hijacks clipboard via Tor.
- Thu 18 Jun, 15:07 UTC. Infosecurity, its first report on the story. Fake GitHub stars drive crypto clipboard hijacker malware. This article, 3rd of 7.
- Thu 18 Jun, 19:00 UTC. Security Affairs, its first report on the story. Tor based clipboard malware steals crypto via USB shortcuts.
- Fri 19 Jun, 00:05 UTC. Ars Technica, its first report on the story. New USB Spread Crypto Clipper malware hijacks wallets via Tor.
- Mon 22 Jun, 16:50 UTC. Dark Reading, its first report on the story. Fake reputation scam spreads clipboard hijacker to steal crypto.
- Wed 24 Jun, 09:30 UTC. SecurityOnline, its first report on the story. Crypto Clipboard Hijacker Hides Behind Fake Stars and Upvotes.
A new cryptocurrency-stealing malware campaign is using fake popularity tactics, like bogus GitHub stars and AI-generated YouTube videos, to deceive users. Check Point Research identified this Rust-based 'clipboard hijacker', which swaps crypto wallet addresses in the clipboard with attacker-controlled addresses. The campaign utilizes multiple fake social media accounts and misleading information to build trust and manipulate victims into downloading the malware.
Once installed, the application monitors clipboard activity and implements techniques to maintain persistence, even on macOS. This strategy represents a concerning evolution in malware distribution, emphasizing false reputational cues to manipulate potential victims.
How the story developed
7 articles from 7 outlets since 17 Jun. Quiet since 24 Jun. This was the 3rd report, 1 day after the first.
- Wed 17 Jun, 13:48 UTC. Check Point, first report. Rust clipboard hijacker steals crypto through fake GitHub apps.
- Thu 18 Jun, 00:47 UTC. Microsoft, its first report on the story. Windows crypto clipper malware hijacks clipboard via Tor.
- Thu 18 Jun, 15:07 UTC. Infosecurity, its first report on the story. Fake GitHub stars drive crypto clipboard hijacker malware. This article, 3rd of 7.
- Thu 18 Jun, 19:00 UTC. Security Affairs, its first report on the story. Tor based clipboard malware steals crypto via USB shortcuts.
- Fri 19 Jun, 00:05 UTC. Ars Technica, its first report on the story. New USB Spread Crypto Clipper malware hijacks wallets via Tor.
- Mon 22 Jun, 16:50 UTC. Dark Reading, its first report on the story. Fake reputation scam spreads clipboard hijacker to steal crypto.
- Wed 24 Jun, 09:30 UTC. SecurityOnline, its first report on the story. Crypto Clipboard Hijacker Hides Behind Fake Stars and Upvotes.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 7 articles as a listHide the list
- Wed 17 JunDay 01
- Rust clipboard hijacker steals crypto through fake GitHub apps13:48 · Check Point · First report
- Thu 18 JunDay 13
- Windows crypto clipper malware hijacks clipboard via Tor00:47 · Microsoft
- Fake GitHub stars drive crypto clipboard hijacker malware15:07 · Infosecurity · This article, 3rd of 7
- Tor based clipboard malware steals crypto via USB shortcuts19:00 · Security Affairs
- Fri 19 JunDay 21
- New USB Spread Crypto Clipper malware hijacks wallets via Tor00:05 · Ars Technica
Quiet for 4 days
Mon 22 JunDay 51- Fake reputation scam spreads clipboard hijacker to steal crypto16:50 · Dark Reading · Picked up again
Quiet for 2 days
Wed 24 JunDay 71- Crypto Clipboard Hijacker Hides Behind Fake Stars and Upvotes09:30 · SecurityOnline