A sophisticated social‑engineering campaign is leveraging AI‑generated YouTube narrators, ghost accounts across multiple platforms, and manipulated reputation signals to distribute a Rust‑based clipboard hijacker that steals cryptocurrency by replacing wallet addresses on victims’ clipboards.
The operation centers on a WordPress phishing hub that advertises “sniper” bots, crash‑game predictors and other get‑rich‑quick tools aimed at crypto traders and gamblers, and uses a coordinated ecosystem of fake engagement to create the illusion of legitimacy.
The actor’s distribution chain begins with a polished phishing page maintained under the handle @JoseCmanXD, which links to GitHub and SourceForge repositories and a dedicated YouTube channel.
On GitHub the operator runs at least six accounts that inter‑contribute and star one another’s repositories, producing thousands of apparent downloads and inflated star/fork counts consistent with previously documented “Ghost Network” activity.
SourceForge project pages show similarly manipulated download numbers and overwhelmingly positive reviews, with a suspicious majority of downloads attributed to Android devices despite the author offering only Windows and macOS builds an indicator of download‑farm inflation.
Checkpoint said in a report shared with GBhackers, YouTube plays a central role in amplifying trust. Videos mimic authentic tutorials showing desktop demonstrations while an AI‑generated narrator speaks from an on‑screen avatar.
View counts exhibit sharp, inorganic spikes and the comment sections are dominated by highly positive, likely coordinated replies. These signals push victims toward the phishing hub and the repositories, reinforcing perceived popularity and effectiveness of the promoted “tools.”
The delivered payloads are Rust‑compiled clipboard hijackers for both Windows and macOS. Windows distribution uses ZIP archives containing a .NET loader that launches a Rust binary; this binary installs persistence under %APPDATA%\silke and registers as a clipboard listener via standard Windows APIs.
Some older videos appear to target a Russian-speaking audience, suggesting that the threat actor initially focused on Russian-speaking user communities.
It continuously inspects clipboard text with regular expressions for wallet patterns across many chains Bitcoin (bech32, legacy, P2SH), Ethereum/EVM, Litecoin, Tron, Cardano, Monero and others and replaces detected addresses with attacker‑controlled wallets drawn from a large embedded list (the Windows variant holds roughly 15,500 addresses).
The macOS variant ships inside a .app with an “unlocker” script that instructs users how to bypass Gatekeeper; it installs LaunchAgent plists and a watchdog loop that self‑heals persistence, monitoring the pasteboard and substituting wallet addresses with hardcoded attacker wallets.
Beyond platform manipulation and video production, the actor tampers with reputation tools. Some VirusTotal entries associated with campaign binaries received benign community votes and “safe” comments, and low AV detection rates combined with these positive signals can mislead both end users and reputation‑based defenses.
n 2022, the user created a post titled BLACKHAT | Bitcoin Stealer | Advanced Builder | Tutorial | Clipper [Address Changer]+Re-Fud method, in which he shared a malicious crypto-related tool.
The campaign also surfaced in paid or compromised posts on legitimate news sites and postings on crypto forums such as BitcoinTalk, lending further deceptive legitimacy.
Operationally, the campaign illustrates a modern evolution: relatively simple malware paired with an aggressive, cross‑platform trust‑fabric built from AI content, ghost networks, and reputation abuse.
Defenders should be aware that visibility metrics stars, views, comments, downloads and community votes can be weaponized to bypass both human skepticism and automated reputation checks.
Mitigations include isolating downloads to sandboxed environments, validating binaries against vendor signatures, monitoring clipboard activity for unauthorized replacements, and treating unusually popular online endorsements with higher scrutiny.
| Description | Value |
|---|---|
| Clipboard Hijacking Malware | 5518942d9d21794aaeff41a01b88606a96659fc329b481a2f0946d8163ab4d61 33c86ecfc324de3af97150bd009aba7925a6ba7a0842e127e94cf351013c0fe6 7a7ad4ae347a3f99f3773a113d9f70ecfa967100c96e8275bd1df833caee68d1 bad8625087a7b9453c70933c0db32518ff5818e3d83f3a9e78d432a22b383edb c1435847b0c437f91efb07a3a35e4468036322d7acf4ba9e6d363cec0b481241 ef9a915c8e1d484e52b3287c94a58ecd22c07391a87f9c136eabd8397ed01ca2 5518942d9d21794aaeff41a01b88606a96659fc329b481a2f0946d8163ab4d61 e02e60a23297692637b43ebcd7dbeb63af1e9680c551586a1ce935218e0034be fb8294b12f904dff2ac79b51872be7bf09ab422cde223caaf4762eadf7e0760d a91c09e0eea610dbe5879798f9cf12e3ce51e4e6f0893278bcdf3ebe22c4730b 9c566db1ef9d08ee389d2b8cc1c50c65870096130c8bd2cf41ea14c4075e94c0 |
| .NET Loader | f737e99177cc05037ff34cf6e245dd56377dc3db4e2bb46edcf039df650939d6 7a9632bbecc31d02fdd0eab07e2424b3e1c9e9a3f91aac4ef6f708f2befbaa3d |
| MacOS Clipboard Hijacking Malware | b71efdebd0ca3563e67edb7ad59358a6b8f013b219ad65033efcf48fd1c86619 |
| MacOS Loader | 6f12c066a929c96104796c4ecca938754962009ebd9e4ba5329bb940bf331d0a |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…