Crypto Clippy Speaks Portuguese
Summary: Unit 42 discovered a cryptocurrency clipper campaign called CryptoClippy that targets Portuguese speakers by using Google Ads and traffic distribution systems to redirect victims searching for "WhatsApp Web" to malicious domains impersonating the legitimate application. The malware monitors the clipboard for bitcoin and Ethereum wallet addresses and replaces them with actor-controlled addresses, and Unit 42 Managed Threat Hunting found victims across manufacturing, IT services, and real estate industries.
What's compelling: The actor-controlled bitcoin wallet has received 0.039954 BTC (roughly $982.83) across four transactions and the Ethereum wallet 0.110915556631181819 ETH (roughly $186.32) from three addresses, with recent activity at the time of writing - and only a handful of vendors on VirusTotal detect the malware, which assigns generic names to it.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026