Full Report
Key Points Introduction In this research, we analyze a clipboard hijacker campaign that is hidden inside a collection of “solutions” and “tools” that claim to give users an unfair advantage. These offers include Solana and Pump.fun sniper bots (automated tools that try to buy new tokens or meme coins faster than other traders), Aviator Predictor […] The post From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker appeared first on Check Point Research.
Analysis Summary
# Tool/Technique: Rust-based Crypto Clipboard Hijacker
## Overview
This campaign involves a cross-platform (Windows and macOS) malware written in Rust, designed to monitor and modify the system clipboard. It targets users seeking high-risk software, such as cryptocurrency "sniper bots" and gambling "predictors." The operation is notable for its extensive use of "reputation fueling"—inflating social proof through fake GitHub stars, AI-generated YouTube content, and manipulated VirusTotal votes to bypass security scrutiny.
## Technical Details
- **Type:** Malware Family (Clipboard Hijacker)
- **Platform:** Windows, macOS
- **Capabilities:** Persistence, Clipboard Monitoring, Regex-based Address Swapping, Reputation Manipulation
- **First Seen:** Approximately June 2024 (based on publication and campaign activity)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1566.002 - Phishing: Spearphishing Link]** (Promoted via YouTube, GitHub, and compromised news sites)
- **[TA0003 - Persistence]**
- **[T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder]** (Windows)
- **[TA0005 - Defense Evasion]**
- **[T1553.006 - Subvert Trust Controls: Code Signing]** (Manipulating VirusTotal reputation/votes)
- **[T1204.002 - User Execution: Malicious File]** (Disguised as legitimate trading tools)
- **[TA0009 - Collection]**
- **[T1513 - Screen Capture]** (Functionality often paired with clipboard monitoring)
- **[T1115 - Clipboard Data]** (Primary mechanism for theft)
## Functionality
### Core Capabilities
- **Clipboard Monitoring:** Continuously scans the system clipboard for strings matching cryptocurrency wallet formats (e.g., Solana, Bitcoin, Ethereum).
- **Address Replacement:** Automatically replaces a victim's copied wallet address with one of thousands of attacker-controlled addresses stored in an internal list.
- **Cross-Platform Compatibility:** Compiled for both Windows (PE files) and macOS (Mach-O) using the Rust programming language.
### Advanced Features
- **Reputation Laundering:** Uses "Ghost Networks" to inflate GitHub stars and SourceForge downloads to appear legitimate.
- **Social Proofing:** Employs AI-generated narrators on YouTube and coordinated comments to provide a false sense of security.
- **Anti-Analysis (Reputation-based):** Threat actors actively vote "Benign" on VirusTotal for their own samples and leave "Safe" comments to mislead automated reputation engines and manual analysts.
## Indicators of Compromise
### File Hashes (SHA256)
- **Rust Clipboard Hijacker:**
- `9c566db1ef9d08ee389d2b8cc1c50c65870096130c8bd2cf41ea14c4075e94c0`
- `fb8294b12f904dff2ac79b51872be7bf09ab422cde223caaf4762eadf7e0760d`
- `b71efdebd0ca3563e67edb7ad59358a6b8f013b219ad65033efcf48fd1c86619` (macOS)
- **Loaders:**
- `f737e99177cc05037ff34cf6e245dd56377dc3db4e2bb46edcf039df650939d6` (.NET)
- `6f12c066a929c96104796c4ecca938754962009ebd9e4ba5329bb940bf331d0a` (macOS)
### File Names
- `Solana_Sniper_Bot.exe`
- `Aviator_Predictor_Setup.zip`
- `Pump.fun_Bot.dmg`
### Network Indicators
- **Distribution Domains:** (Defanged)
- `solana-sniper[.]com`
- `aviator-predictor[.]net`
## Associated Threat Actors
- **Unknown:** Currently tracked as a financially motivated campaign targeting the Web3 and gambling communities.
## Detection Methods
- **Signature-based detection:** Scanning for the embedded list of thousands of hardcoded crypto wallet addresses within the binary.
- **Behavioral detection:** Monitoring for unauthorized modifications to the `Run` registry keys or unauthorized processes accessing clipboard data at high frequency.
- **Reputation Scrutiny:** Cross-referencing VirusTotal comments and GitHub stars against account age and activity patterns (looking for "Ghost Networks").
## Mitigation Strategies
- **Endpoint Protection:** Use EDR solutions that monitor for clipboard hijacking behaviors.
- **Verification:** Always double-check cryptocurrency wallet addresses on a secondary device or via a different medium before confirming transactions.
- **Software Sourcing:** Avoid downloading "grey-area" tools (bots, predictors, hacks) from GitHub repositories or YouTube descriptions, regardless of star counts or positive comments.
## Related Tools/Techniques
- **Laplas Clipper:** A similar clipboard hijacker family.
- **Cryptojacking:** Often paired with clipboard hijacking in crypto-focused campaigns.
- **SEO Poisoning:** Related technique used to boost the visibility of malicious landing pages.