Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and Virus Total Comments
Summary: Check Point Research reports an unknown threat actor using paid or promoted posts on legitimate news sites, a WordPress phishing page, GitHub and SourceForge projects, a YouTube channel with over 91,000 subscribers, and coordinated VirusTotal accounts to distribute a Rust-based cryptocurrency clipboard hijacker hidden in Solana and Pump.fun sniper bots and crash-game predictors. The clipper runs on Windows and macOS, watches the clipboard for wallet-address patterns, and swaps matches with an attacker-controlled address from a hard-coded list; one SourceForge download counter reached 44,485 with 37,460 attributed to Android despite only Windows and macOS builds, and one GitHub repository shows 146 stars and 62 forks.
Bottom line: The campaign's trust signals are manufactured at scale - a 91,000-subscriber YouTube channel with AI narrators, coordinated VirusTotal upvotes, and a press release syndicated across the USA TODAY Network - so the reputation checks your users perform before downloading a tool are themselves the attack surface. Check Point notes the same playbook can easily distribute information stealers or ransomware to higher-value targets over time.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026