Loading story…
Clipsa is a multi-purpose Visual Basic malware family that targeted cryptocurrency users by hijacking clipboard contents, stealing wallet files, and searching infected systems for BIP-39 seed phrases. Distributed as malicious executables disguised as media codec pack installers, the malware copied itself into AppData\Roaming, established persistence through a Windows Run registry key, and communicated with rotating command-and-control infrastructure including poly.ufxtools[.]com. Avast said the campaign also used anti-analysis and anti-debugging techniques and maintained operational statistics in log.dat.
Beyond wallet theft, Clipsa scanned disks for wallet.dat files, looked for mnemonic recovery phrases derived from the widely used 2,048-word BIP-39 English wordlist, and abused search engines to find vulnerable WordPress sites for XML-RPC brute-force attacks against administrator accounts. The malware also downloaded and executed XMRig and another Monero miner, expanding the campaign from credential and crypto theft into illicit cryptomining. Avast reported heavy activity in India, the Philippines, and Brazil, and said more than 253,000 users were protected from over 360,000 infection attempts.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Avast reported that it had protected more than 253,000 users from over 360,000 Clipsa infection attempts since August 1, 2018. The campaign was observed heavily in India, the Philippines, and Brazil.
A commit labeled "Added bip39 english wordlist" was made to the bitcoin/bips repository by admin-slush. The commit identifier shown is ce1862a.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 39 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple threat reports describe widespread use of **clipper malware** that monitors a victim’s clipboard for cryptocurrency wallet addresses and silently replaces them with attacker-controlled values, redirecting funds during transactions. Researchers documented this behavior in standalone families and MaaS offerings including **AvD crypto stealer**, **Clipminer**, **Laplas Clipper**, **WeSteal**, **Evrial**, **Android.Clipper**, and clipper modules bundled into platforms such as **Eternity Project** and **Cinoshi**. Several operations expanded beyond simple wallet replacement to target multiple cryptocurrencies, Steam trade links, and digital payment identifiers, while some samples used lookalike wallet prefixes to reduce user suspicion. The malware has been delivered through trojanized software, cracked applications, spam attachments, phishing documents, fake developer tools, and broader malware chains that also deploy stealers, miners, RATs, botnets, or ransomware. Reports tied clipboard hijacking to campaigns involving **ViperSoftX**, **OriginBotnet**, **DarkCloud**, **Tor2Mine**, and a trojanized **dnSpy** installer, showing that clipboard abuse is often one component of larger financially motivated intrusions. MITRE tracks the underlying behavior as **`T1115` Clipboard Data**, underscoring that clipboard collection and modification remain common techniques for credential theft, fraud, and cryptocurrency theft across Windows and Android environments.
Aug 15, 2026
A malware campaign has been distributing Rust-based cryptocurrency clipboard hijackers for **Windows** and **macOS** by masquerading as crypto trading bots, Solana and Pump.fun sniper bots, Aviator Predictor, and other crash-game predictor tools. Researchers said the operation used a WordPress phishing site as a central hub and boosted credibility through coordinated promotion on **GitHub**, **SourceForge**, **YouTube**, crypto forums, and even posts placed on legitimate news websites, targeting crypto holders, traders, and gamblers seeking quick profits or unfair advantages. On Windows, a **.NET** loader deployed a Rust clipper that stored files under `%APPDATA%`, created Startup shortcut persistence, and swapped copied wallet addresses with attacker-controlled ones from an embedded list of more than **15,500** addresses. On macOS, victims were guided through a loader and an "unlocker" script to bypass **Gatekeeper**, after which a Rust clipper installed **LaunchAgent** persistence and a self-healing watchdog. The activity was linked across platforms through the Telegram handle and WordPress author name `@JoseCmanXD`, while the operators also manipulated **VirusTotal** community sentiment with benign votes and "safe" comments; attacker-controlled wallets reportedly received multiple transactions, indicating successful theft.
Aug 11, 2026
Microsoft disclosed an active Windows cryptocurrency theft campaign that spreads through malicious `.lnk` shortcut files, often delivered via USB devices, and combines worm-like propagation with a script-based clipper and stealer. The malware has been active since February 2026 and uses Windows Script Host, ActiveX, and a bundled Tor client to reach hidden-service command-and-control infrastructure through `localhost:9050`, avoiding conventional installer and IP-based infrastructure. Microsoft said the threat is detected as **Trojan:Win32/CryptoBandits.A** and related **CryptoBandits** signatures. Once installed, the malware monitors the clipboard roughly every 500 milliseconds for **BIP39 seed phrases**, Ethereum keys, Bitcoin WIF keys, and wallet addresses, then replaces copied cryptocurrency addresses with attacker-controlled ones while also stealing screenshots. Microsoft said the operators added persistence through scheduled tasks, Defender exclusions, layered obfuscation, and packaging with **PyArmor** and **PyInstaller**, while also terminating execution if Task Manager is detected. The campaign also supports remote code execution through an `EVAL` command from its C2, effectively giving the operators lightweight backdoor access; defenders were urged to block `.lnk` execution from removable media, restrict script hosts, and hunt for suspicious script activity, clipboard inspection, `curl`-based exfiltration, PowerShell screen capture, and Tor SOCKS5 traffic over `localhost:9050`.
Jul 12, 2026