ATTACKERS are using fabricated GitHub stars and upvotes to push a Rust-based clipboard hijacker that swaps cryptocurrency wallet addresses, according to findings from Check Point Research. The malware targets both Windows and macOS systems, intercepting clipboard contents to replace legitimate addresses with those controlled by the threat actor.
The malware is written in Rust, monitors the clipboard for strings that resemble wallet addresses and replaces them with attacker‑controlled strings. It maintains persistence through registry keys on Windows and launch agents on macOS. Distribution occurs via ZIP files that contain a loader, often presented as tools such as Solana sniper bots or similar trading utilities, as detailed by securityonline.info.
Victims are lured by phishing sites or fake YouTube videos that point to GitHub repositories inflated with fabricated stars; downloading the repository yields a ZIP file that, when opened, executes the loader and installs the clipper. The operation benefits from a ghost network of accounts on Telegram using the handle @JoseCmanXD to generate false reputation, leading to tens of thousands of downloads observed between June 17 and June 24 2026, as reported by Dark Reading.
No CVE identifiers have been assigned to this activity, and the campaign relies entirely on social engineering rather than software vulnerabilities. It shows how threat actors manipulate online reputation metrics to bypass user suspicion, with the clipboard hijacker actively seen in the wild during the reported window, as noted by Infosecurity Magazine.
Users should verify the authenticity of any GitHub project by examining its commit history and looking for genuine contributor activity rather than relying on star counts alone. Employing endpoint detection tools that flag clipboard monitoring behaviour can help catch the malware early. Keeping anti‑malware signatures up to date and blocking known malicious domains associated with the phishing sites reduces risk. Educating staff to double‑check pasted wallet addresses before confirming transactions remains a key safeguard.
Consider using hardware wallets that require physical confirmation of addresses, which defeats clipboard swapping. Report suspicious repositories or videos to platform abuse teams. Monitor for anomalous GitHub activity such as sudden spikes in stars from newly created accounts. Staying vigilant against reputation‑based lures will limit the success of similar campaigns.