Loading malware…
ZigCryptoStealer is cryptocurrency clipboard-hijacking malware written in Zig for Windows. It monitors the clipboard, recognizes cryptocurrency address formats, and replaces matching addresses with attacker-controlled destinations to divert transfers. It uses EtherHiding to retrieve command-and-control configuration from BNB Smart Chain smart contracts, allowing operators to change infrastructure without replacing deployed malware. Variants have used both BNB Smart Chain Testnet and Mainnet.
ZigCryptoStealer has been deployed as a secondary payload in ClearFake infection chains alongside the Amatera information stealer. These chains use compromised websites, malicious Cloudflare Workers, and fake CAPTCHA ClickFix prompts to persuade users to execute commands that retrieve and launch malicious libraries through WebDAV. A subsequent delivery package abuses a legitimate signed Google Chrome component to side-load a NativeAOT loader, which injects ZigCryptoStealer into a suspended Windows shell process. The loader also deploys a signed vulnerable driver to terminate endpoint detection and response and other security processes through a bring-your-own-vulnerable-driver technique.
Its observed use is associated with opportunistic cryptocurrency theft rather than a demonstrated focus on a particular industry. Clipboard address substitution does not itself establish theft of wallet private keys, recovery phrases, or account credentials.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
MITRE ATT&CK™ Matrix - Windows ... Defense Evasion ... File System Logical Offsets
The pf.ch loader uses VEH, XOR, LZNT1, and API hashing; BNB-chain content is encoded JavaScript.
The NativeAOT DLL starts "C:\Windows\"explorer.exe" in a suspended state, manually maps the PE’s headers and sections into the child, changes its initial thread context to the new entry point, and resumes it.
“A separate vulnerable-driver component can terminate security processes.”
Data Collection Combination of other detections shows multiple input capture behaviors ... MITRE ATT&CK™ Matrix - Windows ... Credential Access Input Capture
It polls the clipboard, recognizes several cryptocurrency address formats and can replace matching values with addresses embedded in the payload.
The supplied TTP mapping identifies T1539 — Steal Web Session Cookie.
“The loader searches for EDR products and sends matching process identifiers to the driver.”
MITRE ATT&CK™ Matrix - Windows ... Discovery System Information Discovery
MITRE ATT&CK™ Matrix - Windows ... Discovery File and Directory Discovery
MITRE ATT&CK™ Matrix - Windows ... Collection ... Data from Local System
Data Collection Combination of other detections shows multiple input capture behaviors ... MITRE ATT&CK™ Matrix - Windows ... Credential Access Input Capture
It polls the clipboard, recognizes several cryptocurrency address formats and can replace matching values with addresses embedded in the payload.
This malware stored its C2 domain in the metadata of a BNB Smart Chain contract — an approach commonly known as EtherHiding.
“The malware also uses a blockchain contract to obtain changing command infrastructure. That approach, known as EtherHiding...”
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cryptocurrency stealer delivered as a secondary payload alongside Amatera. It used EtherHiding, storing its C2 domain in BNB Smart Chain contract metadata.
A cryptocurrency-focused stealer deployed as a secondary payload by Amatera Stealer.
Windows-based cryptocurrency clipboard-hijacking malware that monitors copied cryptocurrency addresses and substitutes an attacker-controlled destination address. In the reported chain, it was loaded through a malicious DLL side-loading arrangement involving a genuine Chrome executable and injected into explorer.exe. The clipper can use blockchain data to resolve command-and-control information.
Voleur d'informations écrit en Zig comprenant une fonctionnalité de remplacement d'adresses de portefeuilles de cryptomonnaies dans le presse-papiers. Il utilise EtherHiding et un contrat BNB Smart Chain pour obtenir son domaine de commande et contrôle.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.