Rust Clipboard Hijacker Uses Fake GitHub Stars and VirusTotal Upvotes to Steal Crypto

Cybersecuritynews •Tushar Subhra Dutta • June 18, 2026

A newly discovered malware campaign is quietly draining cryptocurrency wallets by doing something most security tools never see coming. Instead of relying on brute-force attacks or dark web exploits, the threat actor behind this campaign built a fake reputation engine across multiple platforms to make dangerous software look completely safe and trustworthy. The malware at […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Clipboard Hijacker Campaign Manipulates Reputation to Steal Cryptocurrency A clipboard hijacker malware campaign has emerged, targeting cryptocurrency traders and online gamblers. The operation employs fake software tools, including sniper bots and game predictors, to lure victims. It utilizes a WordPress phishing site as a hub, with malware hosted on GitHub and SourceForge, and promoted through AI-narrated YouTube videos. The threat actor employs 'ghost networks' of fake accounts to inflate engagement metrics, such as GitHub stars and VirusTotal votes, creating a false sense of legitimacy. The malware, written in Rust, monitors the clipboard for cryptocurrency wallet addresses and replaces them with attacker-controlled addresses. This campaign has raised concerns about the potential for broader exploitation tactics that could impact enterprises. The current status is ongoing, with the campaign actively distributing its malware via social media and forums. 6 sources 70

Extracted Entities

Rust Clipboard Hijacker Uses Fake GitHub Stars and VirusTotal Upvotes to Steal Crypto

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)