Malware

ZigCryptoStealer

ZigCryptoStealer is a Zig-based Windows cryptocurrency clipper deployed in ClearFake ClickFix infection chains. It is launched through DLL side-loading involving a legitimate Google Chrome component and a NativeAOT loader, which injects the payload into a suspended Explorer process. The malware monitors the Windows clipboard for recognized cryptocurrency wallet-address formats and substitutes attacker-controlled addresses, redirecting victim cryptocurrency transfers. Associated deployment tooling uses a signed vulnerable driver in a bring-your-own-vulnerable-driver attack to terminate identified EDR and security-product processes. ZigCryptoStealer retrieves mutable command-and-control configuration from BNB Smart Chain smart contracts using EtherHiding, allowing operators to rotate infrastructure without replacing the endpoint payload. Delivery has been linked to compromised websites that present fake CAPTCHA-style ClickFix prompts and persuade users to execute commands that retrieve subsequent stages over WebDAV.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

29 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1204User ExecutionEvidence1

“The prompt instructs Windows visitors to open the Run dialog, paste clipboard content, and press Enter.”

T1204.004Malicious Copy and PasteEvidence1

“The prompt instructs Windows visitors to open the Run dialog, paste clipboard content, and press Enter.”

Persistence

2 techniques

T1112Modify RegistryEvidence1

MITRE ATT&CK™ Matrix - Windows ... Defense Evasion ... Modify Registry

T1547.001Registry Run Keys / Startup FolderEvidence1

MITRE ATT&CK™ Matrix - Windows ... Persistence Registry Run Keys / Startup Folder

Privilege Escalation

2 techniques

T1055.012Process HollowingEvidence1

The NativeAOT DLL starts "C:\Windows\"explorer.exe" in a suspended state, manually maps the PE’s headers and sections into the child, changes its initial thread context to the new entry point, and resumes it.

T1547.001Registry Run Keys / Startup FolderEvidence1

MITRE ATT&CK™ Matrix - Windows ... Persistence Registry Run Keys / Startup Folder

Stealth

7 techniques

T1006Direct Volume AccessEvidence1

MITRE ATT&CK™ Matrix - Windows ... Defense Evasion ... File System Logical Offsets

T1027.002Software PackingEvidence1

MITRE ATT&CK™ Matrix - Windows ... Defense Evasion ... Software Packing

T1055.012Process HollowingEvidence1

T1211Exploitation for Defense EvasionEvidence2

“This is a bring-your-own-vulnerable-driver, or BYOVD, attack.”

T1218.011Rundll32Evidence1

“[The command] calls rundll32, a legitimate Windows utility, to execute a library export identified only by a number.”

T1497Virtualization/Sandbox EvasionEvidence1

Anti-Sleep Triggered ... to reveal dormant functionality. ... MITRE ATT&CK™ Matrix - Windows ... Defense Evasion Virtualization / Sandbox Evasion ... Discovery ... Virtualization / Sandbox Evasion

T1564.003Hidden WindowEvidence1

MITRE ATT&CK™ Matrix - Windows ... Defense Evasion ... Hidden Window

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

MITRE ATT&CK™ Matrix - Windows ... Defense Evasion ... Modify Registry

Credential Access

4 techniques

T1056Input CaptureEvidence1

Data Collection Combination of other detections shows multiple input capture behaviors ... MITRE ATT&CK™ Matrix - Windows ... Credential Access Input Capture

T1056.001KeyloggingEvidence1

It polls the clipboard, recognizes several cryptocurrency address formats and can replace matching values with addresses embedded in the payload.

T1552.002Credentials in RegistryEvidence1

MITRE ATT&CK™ Matrix - Windows ... Credential Access ... Credentials in Registry

T1555Credentials from Password StoresEvidence1

Extracted Configuration Vidar configuration was extracted ... Data Collection Tries to read cached credentials of various applications ... MITRE ATT&CK™ Matrix - Windows ... Credential Access Credentials in Files

Discovery

6 techniques

T1012Query RegistryEvidence1

MITRE ATT&CK™ Matrix - Windows ... Discovery Query Registry

T1057Process DiscoveryEvidence2

“The loader searches for EDR products and sends matching process identifiers to the driver.”

T1082System Information DiscoveryEvidence1

MITRE ATT&CK™ Matrix - Windows ... Discovery System Information Discovery

T1083File and Directory DiscoveryEvidence1

MITRE ATT&CK™ Matrix - Windows ... Discovery File and Directory Discovery

T1124System Time DiscoveryEvidence1

MITRE ATT&CK™ Matrix - Windows ... Discovery ... System Time Discovery

T1497Virtualization/Sandbox EvasionEvidence1

Anti-Sleep Triggered ... to reveal dormant functionality. ... MITRE ATT&CK™ Matrix - Windows ... Defense Evasion Virtualization / Sandbox Evasion ... Discovery ... Virtualization / Sandbox Evasion

Collection

6 techniques

T1005Data from Local SystemEvidence1

MITRE ATT&CK™ Matrix - Windows ... Collection ... Data from Local System

T1056Input CaptureEvidence1

Data Collection Combination of other detections shows multiple input capture behaviors ... MITRE ATT&CK™ Matrix - Windows ... Credential Access Input Capture

T1056.001KeyloggingEvidence1

It polls the clipboard, recognizes several cryptocurrency address formats and can replace matching values with addresses embedded in the payload.

T1113Screen CaptureEvidence1

Data Collection Takes screenshot 1 ... MITRE ATT&CK™ Matrix - Windows ... Collection Data Screen Capture

T1115Clipboard DataEvidence4

“ZigCryptoStealer monitors the clipboard for cryptocurrency addresses. It can replace a copied address with one controlled by the attacker.”

T1119Automated CollectionEvidence1

MITRE ATT&CK™ Matrix - Windows ... Collection Automated Collection

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

Network Connection Uses HTTP to upload a large amount of data ... MITRE ATT&CK™ Matrix - Windows ... Command and Control Standard Application Layer Protocol

T1102.001Dead Drop ResolverEvidence4

“The malware also uses a blockchain contract to obtain changing command infrastructure. That approach, known as EtherHiding...”

T1105Ingress Tool TransferEvidence2

“A remote loader retrieves and runs a disguised library through WebDAV.”

Exfiltration

1 technique

T1020Automated ExfiltrationEvidence1

Network Connection Uses HTTP to upload a large amount of data ... MITRE ATT&CK™ Matrix - Windows ... Exfiltration Automated Exfiltration

Other

1 technique

T1562.001Disable or Modify ToolsEvidence4

“The loader searches for EDR products and sends matching process identifiers to the driver, which can force them to stop.”

INDICATORS OF COMPROMISE

IOCs tracked for this family

14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

8 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

cryptika blogNews

Sep 9, 2026

ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools | Cryptika Cybersecurity

A cryptocurrency stealer deployed through ClearFake's DLL side-loading chain. It monitors and replaces copied cryptocurrency wallet addresses, uses EtherHiding and a BNB Smart Chain contract for changing C2 configuration, and is paired with a vulnerable driver that terminates EDR processes.

cyber security newsNews

Sep 9, 2026

ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools

A cryptocurrency stealer deployed by ClearFake that uses a vulnerable signed driver to terminate EDR processes, monitors the clipboard for cryptocurrency wallet addresses, and substitutes attacker-controlled addresses. It uses EtherHiding through a BNB Smart Chain contract to retrieve changing C2 configuration.

malware newsNews

Sep 8, 2026

ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager - Malware News - Malware Analysis, News and Indicators

A Zig-written cryptocurrency stealer and clipboard hijacker. It monitors and substitutes cryptocurrency wallet addresses in the clipboard, and uses a BNB Smart Chain contract as an EtherHiding dead drop to obtain its C2 domain. Its loader also deploys a vulnerable signed driver to terminate EDR and other security processes.

talosintelligence otherNews

Sep 8, 2026

ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

A Zig-based cryptocurrency stealer that monitors the clipboard for cryptocurrency addresses and replaces recognized address formats with attacker-controlled addresses. It uses a BNB Smart Chain contract as an EtherHiding dead drop to obtain its C2 domain.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching14

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping29

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

ZigCryptoStealer