> Concept · clipboard-hijack-cryptocurrency — Replacing copied wallet addresses with attacker-controlled ones_

~/packetpursuit $ cat /intel/concepts/clipboard-hijack-cryptocurrency.md

typeconceptconfidencehighcreated2026-06-09updated2026-06-09collectionimpactmalware-familycollectionimpact

clipboard-hijack-cryptocurrency

Definition

Malware monitors the Windows clipboard for strings that match cryptocurrency address patterns. When the user copies an address (e.g., to send funds), the malware immediately replaces it in the clipboard with an attacker-controlled address, diverting the transaction. Typically combined with C2 notification so the attacker knows which address was replaced and which coin was targeted.

Mechanism

  1. Poll OpenClipboard / GetClipboardData in a loop or via WM_CLIPBOARDUPDATE.
  2. Validate the clipboard text against regexes for supported chains (Bitcoin, Ethereum, etc.).
  3. On match: EmptyClipboard → SetClipboardData(attacker_address).
  4. Optionally WinHttpSendRequest back to C2 with the replaced address and chain type.

Regex Coverage Observed

Chain Regex Pattern Family
Bitcoin Legacy ^[13][a-km-zA-HJ-NP-Z1-9]{25,34}$ unclassified-pe32-clipper
Bitcoin SegWit ^bc1[a-z0-9]{39,59}$ unclassified-pe32-clipper
Bitcoin Bech32m ^bc1p[a-z0-9]{39,59}$ unclassified-pe32-clipper
Ethereum ^0x[a-fA-F0-9]{40}$ unclassified-pe32-clipper
Cardano ^addr1[a-z0-9]{58,104}$ unclassified-pe32-clipper
Monero ^4[0-9AB][1-9A-HJ-NP-Za-km-z]{93,104}$ maskgramstealer
Dogecoin ^D[5-9A-HJ-NP-U][1-9A-HJ-NP-Za-km-z]{32}$ unclassified-pe32-clipper
... (14 total for f936b99e) See full regex table in analysis unclassified-pe32-clipper

Defensive Notes

  • Clipboard watchers register via AddClipboardFormatListener; EDR products can hook this API.
  • Address validation delay: Some wallets now show address checksum; malware cannot forge a valid checksumed address unless it also patches the wallet UI.
  • Hardware wallets bypass the clipboard entirely for critical transactions.

Related