Netcrook
#Crypto Clipper
The Browser Add-on That Turns Copy-Paste Into a Crypto Trap
A disguised Chromium extension linked to wallet-address swapping shows how a small permissioned add-on can become a last-mile fraud tool.
The Fake Rental Trap Behind a New Android RAT
A decoy apartment site, a dropped APK, and a loader chain that turns a simple lure into a mobile account-abuse risk.
The Browser Was the Wallet Thief: A Fake Notes Extension and the Quiet Swap Attack
A disguised browser add-on linked to a crypto clipper campaign shows how transaction tampering can happen inside the browser, not on the blockchain.
When a Notes Add-On Becomes a Payment Trap: The Silent Swap Crypto Clip
Researchers flagged a browser-extension campaign that impersonates a familiar note-taking tool and aims to swap cryptocurrency wallet addresses at transaction time.
CryptoBandits Turns a USB Habit Into a Crypto Theft Risk
A new Windows malware family is reported to spread through USB devices and use Tor, while altering wallet addresses to steal cryptocurrency.
Fake Popularity, Real Theft: The Clip-on Trap Hiding Behind GitHub Stars and VirusTotal Votes
A deceptive trust layer is being abused to make a crypto clipper look safer than it is, turning stars, reviews, and clipboard swaps into a quiet route to theft.
When a Clipper Hides Behind Tor, the Hunt Moves Off the Network Map
A Windows crypto-clipper campaign is notable less for the theft itself than for the way it routes control through a local SOCKS5 proxy and Tor, reducing the value of simple IP-based hunting.
Windows Script Hosts and Tor: The Hidden Path in a Crypto Clipper Campaign
A Windows-based crypto clipper reportedly leans on WScript, ActiveXObject, and Tor, a combination that can blur the line between ordinary scripting and malicious automation.
USB, Tor, and a Wallet Thief: A Small Malware Build With Outsized Reach
A newly spotted lightweight backdoor combines removable-media spread with cryptocurrency theft, showing how compact malware can still punch through modern defenses.
Windows Scripting, USB Shortcuts, and Tor: The Hidden Machinery Behind a Crypto Clipper
Microsoft says a Windows-based cryptocurrency clipper has been active since February 2026, and its design leans on built-in scripting, shortcut abuse, and Tor-hosted command infrastructure.
When a Friendly Voice Becomes the Bait: How Crypto Clippers Borrow Trust Before Stealing It
A reported campaign pairs AI-style narration, fake reputation signals, and a Rust-based clipboard hijacker to quietly redirect cryptocurrency payments.
Clipboard Crime by Design: Script Chains Turn a Simple Paste into Crypto Risk
A reported CountLoader campaign shows how obfuscated JavaScript and PowerShell can be chained into a clipboard-hijacking clipper aimed at cryptocurrency wallets.
When a Loader Hides in Plain Sight, the Clipboard Becomes the Target
A reported CountLoader campaign shows how Windows-native scripts, staged execution, and memory-resident payloads can turn a routine infection path into a theft mechanism aimed at crypto users.