Skip to content

Fake-reputation crypto clipboard hijacker

Summary

Check Point Research reported a cryptocurrency clipboard-hijacker campaign that uses fake reputation across multiple public platforms to make malicious "trading", "sniper bot", and gambling-predictor tools look safe. The same operation promotes Windows and macOS Rust clippers through a WordPress phishing hub, GitHub and SourceForge projects, AI-narrated YouTube videos, crypto forums, news-site posts, and benign-looking VirusTotal community votes or comments.

The durable threat-intelligence value is not just another clipper payload. The campaign shows how adversaries can manipulate social proof, stars, forks, comments, downloads, views, reviews, and "safe" votes, to weaken user judgment and reputation-based triage before the victim ever runs the malware.

Tags

Why this matters

  • Reputation signals are part of the lure: Check Point observed coordinated-looking positive engagement across GitHub, SourceForge, YouTube, forums, news-site posts, and VirusTotal.
  • The payloads target both Windows and macOS users, so "Mac-only" cryptocurrency or gambling audiences are not outside the blast radius.
  • The malware's goal is silent transaction redirection: it waits for cryptocurrency wallet-like strings in the clipboard and replaces them with attacker-controlled wallet addresses.
  • Positive community votes or comments on reputation services should not be treated as clean verdicts when the file's distribution path, user intent, or behavior is suspicious.
  • The same fake-reputation playbook can be reused for more damaging payloads than clippers, including stealers or initial-access malware.

Operational characteristics

  • Lures: the phishing site advertised tools such as Solana / Pump.fun / DEX sniper bots, Aviator Predictor, and crash-game predictors, targeting cryptocurrency owners, gamblers, and traders looking for shortcuts.
  • Operator persona: Check Point tied the WordPress author, Telegram contact, YouTube contact details, and older forum activity to the @JoseCmanXD handle; treat this as an online persona, not a verified human identity.
  • Platform promotion: Check Point identified GitHub accounts including Decryptor-j, crash-predictor1, roblox-script1, hack-scripts, and stake-mines promoting related repositories and appearing to reinforce each other through stars, forks, and contributor links.
  • Download scale: Check Point estimated just over 5,000 downloads and potential infections from the GitHub accounts it reviewed, including more than 1,250 downloads associated with a macOS "Aviator Predictor" build. SourceForge statistics showed 44,485 downloads, but Check Point assessed the numbers as suspiciously manipulated, including a large Android-origin share despite only Windows and macOS builds being offered.
  • YouTube layer: the actor used a YouTube channel with suspicious view spikes, positive comments, older Russian-language targeting, newer English-language targeting, and AI-generated narrators over desktop demonstrations.
  • VirusTotal sentiment abuse: Check Point observed benign votes and "safe" comments on some campaign samples, creating false reassurance when paired with low detection rates.
  • News and forum promotion: posts on legitimate news-oriented sites and cryptocurrency forums linked back to the phishing hub. Check Point said it was unclear whether the news posts were paid/promoted posts or abuse of compromised publishing paths.
  • Windows chain: victims downloaded ZIP archives. A visible .exe acted as a .NET loader and executed src/config/silkebin.exe, a Rust clipboard hijacker.
  • Windows persistence: the clipper copied itself to %APPDATA%\silke\silke.exe and created a Startup-folder shortcut, then used Windows clipboard APIs including AddClipboardFormatListener, OpenClipboard, GetClipboardData, EmptyClipboard, and SetClipboardData.
  • Wallet replacement: the Windows build checked clipboard text against cryptocurrency-address regular expressions and used an embedded list of more than 15,500 attacker-controlled wallet addresses, including about 15,000 Bitcoin-related addresses and roughly 500 Ethereum / EVM addresses.
  • macOS execution: the macOS packages included an !!! READ THIS - RUN UNLOCKER IF APP IS BLOCKED.txt instruction file that told users to run unlocker.command, which removed quarantine attributes with xattr -cr and opened the selected .app, bypassing Gatekeeper friction through social engineering.
  • macOS persistence: the Rust macOS clipper wrote ~/launch.sh, installed a LaunchAgent at ~/Library/LaunchAgents/com.example..plist with RunAtLoad and KeepAlive, and used a 30-second watchdog loop to rewrite persistence files and clone the binary with fcopyfile.

Defender heuristics

  • Treat inflated stars, forks, SourceForge downloads, YouTube engagement, news-site posts, and VirusTotal community comments as weak signals unless backed by code provenance, publisher history, deterministic scanning, and behavioral analysis.
  • For crypto, gambling, and trading communities, warn users that "sniper bot", "predictor", "unlocker", and "free premium" tools are high-risk malware lures even when they appear popular.
  • Hunt Windows endpoints for %APPDATA%\silke\silke.exe, Startup-folder shortcuts pointing to silke.exe, ZIP-extracted trading / predictor tools, and processes using clipboard listener APIs unexpectedly.
  • Hunt macOS endpoints for unlocker.command, recent xattr -cr use against untrusted .app bundles, ~/launch.sh, ~/Library/LaunchAgents/com.example..plist, and LaunchAgents with suspicious RunAtLoad / KeepAlive clipboard-monitoring binaries.
  • In EDR and malware triage, flag binaries that match wallet-address regular expressions and call clipboard read/write APIs in a loop, especially when distributed through social proof-heavy repositories or file-sharing pages.
  • Review cryptocurrency-transfer incidents for clipboard-replacement behavior: copied address differs from pasted address, first loss occurs soon after installing a trading or prediction tool, or the endpoint shows unexpected clipboard-monitoring persistence.
  • Do not rely on VirusTotal upvotes, comments, or low detection rates as a clean verdict; record them as potentially manipulated context and prioritize behavior and provenance.

Sources