CryptoClippy: New Malware Targets Portuguese Cryptocurrency Users
April 5, 2023
Cyber Threat / Malware
A newly identified malware, dubbed CryptoClippy, is specifically targeting Portuguese cryptocurrency users through a malvertising campaign. This sophisticated malware employs SEO poisoning techniques to lure users searching for “WhatsApp web” to malicious domains that host the threat, according to a recent report from Palo Alto Networks’ Unit 42.
CryptoClippy, written in C, is a type of cryware known as clipper malware, which monitors clipboard activity for cryptocurrency addresses. When it detects a match, the malware substitutes the copied address with one controlled by the attacker. “The clipper malware utilizes regular expressions (regexes) to ascertain the cryptocurrency type of the address,” noted researchers from Unit 42. “It then replaces the clipboard entry with a visually similar wallet address belonging to the adversary.”
Cyber Threat / Malware
CryptoClippy Emerges as New Threat Targeting Portuguese Cryptocurrency Users April 05, 2023 A concerning new malware known as CryptoClippy is currently posing risks to cryptocurrency users in Portugal, as reported by cybersecurity experts at Palo Alto Networks’ Unit 42. This malware is part of a malvertising campaign that capitalizes on…
CryptoClippy: New Malware Targets Portuguese Cryptocurrency Users
April 5, 2023
Cyber Threat / Malware
A newly identified malware, dubbed CryptoClippy, is specifically targeting Portuguese cryptocurrency users through a malvertising campaign. This sophisticated malware employs SEO poisoning techniques to lure users searching for “WhatsApp web” to malicious domains that host the threat, according to a recent report from Palo Alto Networks’ Unit 42.
CryptoClippy, written in C, is a type of cryware known as clipper malware, which monitors clipboard activity for cryptocurrency addresses. When it detects a match, the malware substitutes the copied address with one controlled by the attacker. “The clipper malware utilizes regular expressions (regexes) to ascertain the cryptocurrency type of the address,” noted researchers from Unit 42. “It then replaces the clipboard entry with a visually similar wallet address belonging to the adversary.”
