Loading story…
Researchers and malware-tracking services identified Allcome as a clipbanker malware family sold in underground forums and designed to monitor a victim’s clipboard, then silently replace copied payment data with attacker-controlled values. The malware targets cryptocurrency wallet addresses, PayPal email addresses, Steam trade offer URLs, and other payment-related links, using simple string-matching rules to swap legitimate destination data for fraudulent alternatives at the moment a user pastes it.
Analysis indicates Allcome was marketed as a subscription-based criminal service with multiple pricing tiers and operator support, underscoring its role as a commoditized malware offering rather than a one-off tool. MalwareBazaar tracked 28 samples associated with the AllcomeClipper family, with sightings spanning from 2022-01-26 to 2023-06-30, while researchers noted that its PayPal replacement logic is unusually noisy because it can alter nearly any copied email-like string, increasing the chance that victims detect the compromise.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
MalwareBazaar recorded its first-seen timestamp for malware samples classified under the AllcomeClipper family. This marks the earliest explicit observation of the family in the provided sources.
MalwareBazaar recorded the last-seen timestamp for AllcomeClipper samples in its database entry. The entry states that 28 samples associated with the family had been identified by that point.
G DATA published an analysis describing Allcome as a clipbanker malware service that replaces copied cryptocurrency wallet addresses, PayPal addresses, Steam trade URLs, and other payment links with attacker-controlled values. The report also noted underground marketing for the malware with subscription pricing and support contact details.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple threat reports describe widespread use of **clipper malware** that monitors a victim’s clipboard for cryptocurrency wallet addresses and silently replaces them with attacker-controlled values, redirecting funds during transactions. Researchers documented this behavior in standalone families and MaaS offerings including **AvD crypto stealer**, **Clipminer**, **Laplas Clipper**, **WeSteal**, **Evrial**, **Android.Clipper**, and clipper modules bundled into platforms such as **Eternity Project** and **Cinoshi**. Several operations expanded beyond simple wallet replacement to target multiple cryptocurrencies, Steam trade links, and digital payment identifiers, while some samples used lookalike wallet prefixes to reduce user suspicion. The malware has been delivered through trojanized software, cracked applications, spam attachments, phishing documents, fake developer tools, and broader malware chains that also deploy stealers, miners, RATs, botnets, or ransomware. Reports tied clipboard hijacking to campaigns involving **ViperSoftX**, **OriginBotnet**, **DarkCloud**, **Tor2Mine**, and a trojanized **dnSpy** installer, showing that clipboard abuse is often one component of larger financially motivated intrusions. MITRE tracks the underlying behavior as **`T1115` Clipboard Data**, underscoring that clipboard collection and modification remain common techniques for credential theft, fraud, and cryptocurrency theft across Windows and Android environments.
Aug 15, 2026
Cyble researchers reported a newly identified Linux malware family, **ClipXDaemon**, that targets X11 desktop sessions by continuously monitoring clipboard contents (about every **200 ms**) and covertly replacing copied cryptocurrency wallet addresses with attacker-controlled ones to divert funds. The malware is designed to operate **without command-and-control (C2) infrastructure**, enabling direct monetization while reducing network-based detection opportunities; it uses standard **X11 APIs** to connect to the X server and perform clipboard tracking and manipulation. Infections were observed starting from a loader whose structure resembles the earlier Linux threat **ShadowHS**, including use of a *bincrypter*-generated script to decrypt and launch a memory-resident dropper that ultimately executes ClipXDaemon. The malware establishes persistence by appending an execution line (avoiding root privileges, scheduled tasks, or systemd services) and uses **double-fork daemonization** to evade inspection tools. Reported targeting includes multiple wallet formats—at least **Bitcoin, Ethereum, Litecoin, Monero, Tron, Dogecoin** (with additional monitoring noted for **Ripple** and **TON** in one report)—with wallet patterns and replacement data protected via encryption (including **ChaCha20** in the analyzed binary), and the payload was reported as undetected on VirusTotal at the time of analysis.
Jun 29, 2026
A malware campaign has been distributing Rust-based cryptocurrency clipboard hijackers for **Windows** and **macOS** by masquerading as crypto trading bots, Solana and Pump.fun sniper bots, Aviator Predictor, and other crash-game predictor tools. Researchers said the operation used a WordPress phishing site as a central hub and boosted credibility through coordinated promotion on **GitHub**, **SourceForge**, **YouTube**, crypto forums, and even posts placed on legitimate news websites, targeting crypto holders, traders, and gamblers seeking quick profits or unfair advantages. On Windows, a **.NET** loader deployed a Rust clipper that stored files under `%APPDATA%`, created Startup shortcut persistence, and swapped copied wallet addresses with attacker-controlled ones from an embedded list of more than **15,500** addresses. On macOS, victims were guided through a loader and an "unlocker" script to bypass **Gatekeeper**, after which a Rust clipper installed **LaunchAgent** persistence and a self-healing watchdog. The activity was linked across platforms through the Telegram handle and WordPress author name `@JoseCmanXD`, while the operators also manipulated **VirusTotal** community sentiment with benign votes and "safe" comments; attacker-controlled wallets reportedly received multiple transactions, indicating successful theft.
Aug 11, 2026