From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker

MITRE Techniques

• [T1583.001 ] Acquire Infrastructure: Domains – The actor uses a dedicated phishing website as the main distribution hub (‘A WordPress phishing site serves as the main landing page’).
• [T1587.001 ] Develop Capabilities: Malware – The threat actor develops Rust-based clipboard hijackers for Windows and macOS (‘the actual payloads delivered to victims are Rust-based clipboard hijackers’).
• [T1204.001 ] User Execution: Malicious Link – Victims are funneled to the phishing page via social media, forums, and Telegram links (‘In most cases, victims are funneled to this site through links shared on social media, crypto forums, and Telegram channels’).
• [T1566.002 ] Phishing: Spearphishing Link – The phishing site and linked content are used to lure users into downloading the malicious software (‘a dedicated phishing page as the central hub’).
• [T1012 ] Query Registry – The malware uses Windows and macOS system mechanisms and checks system paths/settings to maintain operation and persistence (‘copies itself to %APPDATA%silkesilke.exe’ and ‘installs a RunAtLoad and KeepAlive LaunchAgent plist’).
• [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – The Windows variant creates a shortcut in the Startup folder so it runs at logon (‘creating a shortcut in the Startup folder so it will automatically run at logon’).
• [T1547.013 ] Boot or Logon Autostart Execution: XDG Autostart / Launch Agents – The macOS variant installs a LaunchAgent for automatic execution on login (‘installs a RunAtLoad and KeepAlive LaunchAgent plist’).
• [T1112 ] Modify Registry – On Windows, the sample modifies startup-related persistence to ensure execution (‘creating a shortcut in the Startup folder’).
• [T1056.001 ] Input Capture: Keylogging – Not directly keylogging, but the clipper captures clipboard input and reacts when wallet text appears (‘continuously monitors the user’s clipboard for cryptocurrency wallet addresses’).
• [T1115 ] Clipboard Data – The malware monitors clipboard content and swaps wallet addresses (‘replace the clipboard contents with an attacker-controlled wallet address’).
• [T1036 ] Masquerading – The campaign disguises malicious software as legitimate tools and uses fake trust signals (‘tools that claim to give users an unfair advantage’ and ‘appear more popular and trustworthy than they really are’).
• [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – The macOS unlocker bypasses protective controls before execution (‘remove the macOS quarantine attribute’ and ‘bypass Gatekeeper warnings’).
• [T1585.001 ] Establish Accounts: Social Media Accounts – The actor uses fake or controlled accounts across platforms (‘fake accounts’, ‘Ghost Networks’).
• [T1593 ] Search Open Websites/Domains – The actor promotes malware through news websites, forums, and public platforms (‘posts on legitimate news websites’ and ‘BitcoinTalk.org’).