Loading story…
Cyble researchers reported a newly identified Linux malware family, ClipXDaemon, that targets X11 desktop sessions by continuously monitoring clipboard contents (about every 200 ms) and covertly replacing copied cryptocurrency wallet addresses with attacker-controlled ones to divert funds. The malware is designed to operate without command-and-control (C2) infrastructure, enabling direct monetization while reducing network-based detection opportunities; it uses standard X11 APIs to connect to the X server and perform clipboard tracking and manipulation.
Infections were observed starting from a loader whose structure resembles the earlier Linux threat ShadowHS, including use of a bincrypter-generated script to decrypt and launch a memory-resident dropper that ultimately executes ClipXDaemon. The malware establishes persistence by appending an execution line (avoiding root privileges, scheduled tasks, or systemd services) and uses double-fork daemonization to evade inspection tools. Reported targeting includes multiple wallet formats—at least Bitcoin, Ethereum, Litecoin, Monero, Tron, Dogecoin (with additional monitoring noted for Ripple and TON in one report)—with wallet patterns and replacement data protected via encryption (including ChaCha20 in the analyzed binary), and the payload was reported as undetected on VirusTotal at the time of analysis.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Cyble researchers publicly reported on ClipXDaemon in March 2026, describing its C2-less design, in-memory loader chain, user-level persistence via shell profile modification, and clipboard monitoring of multiple cryptocurrency address formats. The analysis also noted that the malware exits on Wayland systems and is harder to detect through network-based defenses because it uses no DNS, HTTP, sockets, domains, or IPs.
In early February 2026, researchers observed a multi-stage infection chain delivering ClipXDaemon, a Linux clipboard hijacker aimed at cryptocurrency users on X11 desktop environments. The malware replaced copied wallet addresses with attacker-controlled ones to steal funds during transactions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed an active Windows cryptocurrency theft campaign that spreads through malicious `.lnk` shortcut files, often delivered via USB devices, and combines worm-like propagation with a script-based clipper and stealer. The malware has been active since February 2026 and uses Windows Script Host, ActiveX, and a bundled Tor client to reach hidden-service command-and-control infrastructure through `localhost:9050`, avoiding conventional installer and IP-based infrastructure. Microsoft said the threat is detected as **Trojan:Win32/CryptoBandits.A** and related **CryptoBandits** signatures. Once installed, the malware monitors the clipboard roughly every 500 milliseconds for **BIP39 seed phrases**, Ethereum keys, Bitcoin WIF keys, and wallet addresses, then replaces copied cryptocurrency addresses with attacker-controlled ones while also stealing screenshots. Microsoft said the operators added persistence through scheduled tasks, Defender exclusions, layered obfuscation, and packaging with **PyArmor** and **PyInstaller**, while also terminating execution if Task Manager is detected. The campaign also supports remote code execution through an `EVAL` command from its C2, effectively giving the operators lightweight backdoor access; defenders were urged to block `.lnk` execution from removable media, restrict script hosts, and hunt for suspicious script activity, clipboard inspection, `curl`-based exfiltration, PowerShell screen capture, and Tor SOCKS5 traffic over `localhost:9050`.
Jun 29, 2026
A malware campaign has been distributing Rust-based cryptocurrency clipboard hijackers for **Windows** and **macOS** by masquerading as crypto trading bots, Solana and Pump.fun sniper bots, Aviator Predictor, and other crash-game predictor tools. Researchers said the operation used a WordPress phishing site as a central hub and boosted credibility through coordinated promotion on **GitHub**, **SourceForge**, **YouTube**, crypto forums, and even posts placed on legitimate news websites, targeting crypto holders, traders, and gamblers seeking quick profits or unfair advantages. On Windows, a **.NET** loader deployed a Rust clipper that stored files under `%APPDATA%`, created Startup shortcut persistence, and swapped copied wallet addresses with attacker-controlled ones from an embedded list of more than **15,500** addresses. On macOS, victims were guided through a loader and an "unlocker" script to bypass **Gatekeeper**, after which a Rust clipper installed **LaunchAgent** persistence and a self-healing watchdog. The activity was linked across platforms through the Telegram handle and WordPress author name `@JoseCmanXD`, while the operators also manipulated **VirusTotal** community sentiment with benign votes and "safe" comments; attacker-controlled wallets reportedly received multiple transactions, indicating successful theft.
Jun 29, 2026
Researchers reported an active **Silent Swap** campaign that distributes a fake **"Google Notes"** browser extension to steal cryptocurrency by replacing copied wallet addresses with attacker-controlled ones during transactions. The operation uses unsigned **.NET** and **Golang** installers to silently sideload the malicious extension into Chromium-based browsers including **Chrome, Edge, Brave, and Opera**, where it monitors clipboard activity and browser input for wallet strings across multiple blockchains and swaps them in real time. The malware reportedly abuses Chromium trust mechanisms by altering **Secure Preferences** and related settings files, recalculating integrity values so the extension appears legitimately installed without user approval. Researchers said the campaign also uses **EtherHiding**-style blockchain-based command-and-control, querying a smart contract through public RPC infrastructure to resolve active C2 domains such as `devops-offensive[.]cc` and `Zebregts[.]com`, complicating detection and takedown. The activity has been linked to the **CountLoader** threat actor, with infections observed globally and a heavier concentration in **India**, while dynamic per-victim wallet mapping and published hashes, domains, payload URLs, and Bitcoin wallet indicators suggest a broad effort to monetize consumer cryptocurrency transactions.
Jul 2, 2026