The Fake “RedLine”: Imposter Malware Hijacks Crypto Wallets on Discord

The Fake “RedLine” report details a sophisticated new cybercrime operation in which a threat actor, called RedLineCyber, masquerades as an affiliate of RedLine Solutions to deploy a stealthy clipboard hijacker via Discord, aiming to drain cryptocurrency wallets. According to CloudSEK’s STRIKE team, the attackers cultivate trust within private gaming, gambling, and streaming discord communities after conducting HUMINT investigations in December 2025.

The malware, often named Pro.exe or peeek.exe, is pitched as a security tool or streaming utility and is written in Python, operating mainly offline to avoid triggering network-based detections. It monitors the Windows clipboard for cryptocurrency wallet addresses and automatically substitutes attacker-controlled addresses, with victims realising the theft only when they paste a recipient address.

The campaign targets six major cryptocurrencies—Bitcoin, Ethereum, Solana, Dogecoin, Litecoin, and Tron—and avoids traditional exfiltration methods by not contacting a C2 server, thereby staying under the radar.