As cited
Copy frozen at (site build).
threat intel
From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker
A threat actor is distributing a Rust-based clipboard hijacker disguised as cryptocurrency trading bots and game prediction tools across multiple platforms, including fake GitHub and SourceForge repositories, a YouTube channel with AI-generated content, and compromised news sites. The operation uses coordinated fake accounts, inflated engagement metrics, and manipulated VirusTotal reputation signals to create a false appearance of legitimacy and trustworthiness. Once installed, the malware monitors the clipboard for cryptocurrency wallet addresses and replaces them with attacker-controlled addresses, generating illicit cryptocurrency transactions.
Why it matters: Cryptocurrency traders and crash-game gamblers are at immediate risk of wallet hijacking and financial loss; security practitioners should monitor for this malware across detection systems and educate users that reputation signals on GitHub, YouTube, and VirusTotal can be artificially manipulated to bypass trust-based decisions.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker
A threat actor operates a multi-platform campaign distributing Rust-based clipboard hijackers disguised as cryptocurrency trading tools and game predictors. The campaign uses fake social proof across GitHub, SourceForge, YouTube, and VirusTotal to establish credibility, combined with phishing pages, compromised news outlets, and coordinated fake accounts to amplify perceived legitimacy. The malware monitors clipboards for cryptocurrency wallet addresses and replaces them with attacker-controlled wallets, enabling theft from crypto users and online gamblers.
Why it matters: Crypto traders and online gamblers are at immediate risk from credential theft and wallet address replacement; practitioners should educate users to verify tool authenticity and monitor for clipboard manipulation attacks, especially those leveraging social proof manipulation on technical platforms.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker
A threat actor operates a multi-platform campaign distributing Rust-based clipboard hijackers disguised as cryptocurrency trading tools and game predictors. The campaign uses fake social proof across GitHub, SourceForge, YouTube, and VirusTotal to establish credibility, combined with phishing pages, compromised news outlets, and coordinated fake accounts to amplify perceived legitimacy. The malware monitors clipboards for cryptocurrency wallet addresses and replaces them with attacker-controlled wallets, enabling theft from crypto users and online gamblers.
Why it matters: Crypto traders and online gamblers are at immediate risk from credential theft and wallet address replacement; practitioners should educate users to verify tool authenticity and monitor for clipboard manipulation attacks, especially those leveraging social proof manipulation on technical platforms.
- Source published
- First seen by Cybersecurity Tracker