Loading story…
A malicious Android app posing as MetaMask was discovered on Google Play, marking the first reported case of clipper malware identified in the official Android app store. ESET detected the app as Android/Clipper.C and found that it targeted users looking for a mobile version of MetaMask, even though MetaMask at the time was available only as browser extensions for Chrome and Firefox.
The malware was built to steal Ethereum wallet credentials and private keys, and it could also monitor the clipboard and replace copied Bitcoin or Ethereum wallet addresses with attacker-controlled addresses to redirect cryptocurrency payments. According to ESET, the malicious package was uploaded to Google Play on February 1 and was removed after the company notified Google’s security team.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
In February 2019, ESET researchers discovered what the source describes as the first reported clipper malware on the official Google Play store. The campaign targeted users looking for a nonexistent mobile MetaMask app.
A malicious app package named com.lemon.metamask, detected by ESET as Android/Clipper.C, was introduced to Google Play while impersonating MetaMask. It was designed to steal Ethereum wallet credentials and private keys and to replace copied cryptocurrency wallet addresses with attacker-controlled ones.
The source says Android clipper malware had previously been observed in shady Android app stores in 2018, predating its discovery in Google Play.
The source states that clipper malware first appeared on Windows in 2017, providing background on the malware family before its appearance on Android and Google Play.
After ESET notified Google's security team about the fake MetaMask clipper app, Google removed it from the Play Store. The source does not provide a specific date for the removal.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple threat reports describe widespread use of **clipper malware** that monitors a victim’s clipboard for cryptocurrency wallet addresses and silently replaces them with attacker-controlled values, redirecting funds during transactions. Researchers documented this behavior in standalone families and MaaS offerings including **AvD crypto stealer**, **Clipminer**, **Laplas Clipper**, **WeSteal**, **Evrial**, **Android.Clipper**, and clipper modules bundled into platforms such as **Eternity Project** and **Cinoshi**. Several operations expanded beyond simple wallet replacement to target multiple cryptocurrencies, Steam trade links, and digital payment identifiers, while some samples used lookalike wallet prefixes to reduce user suspicion. The malware has been delivered through trojanized software, cracked applications, spam attachments, phishing documents, fake developer tools, and broader malware chains that also deploy stealers, miners, RATs, botnets, or ransomware. Reports tied clipboard hijacking to campaigns involving **ViperSoftX**, **OriginBotnet**, **DarkCloud**, **Tor2Mine**, and a trojanized **dnSpy** installer, showing that clipboard abuse is often one component of larger financially motivated intrusions. MITRE tracks the underlying behavior as **`T1115` Clipboard Data**, underscoring that clipboard collection and modification remain common techniques for credential theft, fraud, and cryptocurrency theft across Windows and Android environments.
Aug 15, 2026
ESET researchers uncovered dozens of fake **WhatsApp** and **Telegram** websites distributing trojanized Android and Windows installers aimed largely at Chinese-speaking users trying to access blocked messaging services outside official app stores. The malicious Android apps included the first observed **clipper** malware embedded in instant messaging clients, replacing cryptocurrency wallet addresses in chats so funds would be redirected to attacker-controlled accounts. Some samples also used **OCR** to scan screenshots and photos for wallet recovery phrases, while other variants exfiltrated messages, Telegram data, device details, and files. On Windows, the campaign delivered both Telegram clippers and bundled **remote access trojans (RATs)** that enabled keylogging, clipboard theft, screen capture, and file operations. Victims were lured through **Google Ads**, fraudulent YouTube channels, and counterfeit download pages impersonating legitimate messaging services. ESET said the operation reflects a broader cryptocurrency-theft ecosystem built around fake messaging apps and reported the malicious ads and channels to Google, which removed them.
Jul 12, 2026
Attackers have been running an Android malware campaign against customers of eight Malaysian banks by posing as local businesses, including cleaning services and a pet store, through fake e-commerce websites promoted with Facebook ads and lookalike domains. Victims who click bogus Google Play download buttons on the copycat sites receive malicious Android apps hosted on attacker-controlled servers rather than the official app store. The malware steals online banking credentials by presenting a fake **FPX** payment page and then intercepts two-factor authentication by forwarding all incoming SMS messages to the attackers. ESET linked several of the malicious apps to the same threat actor through shared code and said the operation, first spotted in late 2021, was still active with newly registered distribution domains.
Aug 14, 2026