Rust Clipboard Hijacker Uses Fake GitHub Stars and VirusTotal Upvotes to Steal Crypto

A newly discovered malware campaign is quietly draining cryptocurrency wallets by doing something most security tools never see coming.

Instead of relying on brute-force attacks or dark web exploits, the threat actor behind this campaign built a fake reputation engine across multiple platforms to make dangerous software look completely safe and trustworthy.

The malware at the center of it all is a clipboard hijacker written in Rust, a programming language known for its speed and low-level control.

It runs silently in the background, watches for any cryptocurrency wallet address copied to the clipboard, and swaps it with an address controlled by the attacker.

By the time a victim completes a transfer, the funds go to the wrong wallet with no way to reverse the transaction.

Analysts at Check Point Research said in a report shared with Cyber Security News (CSN) that they identified the full scope of this campaign, noting how the threat actor built an entire ecosystem to deliver and disguise the malware.

The operation targets crypto traders, online gamblers, and anyone searching for shortcuts to quick profits, luring them with fake tools like Solana sniper bots, Aviator Predictors, and crash-game forecasters.

None of these tools work as advertised. They all serve as delivery vehicles for the clipboard hijacker. What makes this campaign stand out is not the malware itself, but the elaborate web of fake credibility surrounding it.

The attacker used a WordPress phishing site as the main hub and pointed victims toward GitHub, SourceForge, and YouTube, all showing inflated engagement from fake accounts.

Combined with low detection rates on security platforms, it created a convincing illusion of legitimacy that even careful users could fall for.

Rust Clipboard Hijacker

The threat actor operates at least six GitHub accounts, including Decryptor-j, crash-predictor1, and roblox-script1, using Ghost Networks to inflate repository stars and forks artificially.

One repository showed 146 stars and 62 forks, all likely generated by coordinated fake accounts.

From GitHub alone, researchers counted over 5,000 downloads, with more than 1,250 tied to the macOS “Aviator Predictor” tool.

SourceForge told a similar story, recording 44,485 total downloads, though most appear suspicious.

A large portion came from Android devices even though only Windows and macOS versions exist, strongly suggesting an Android device farm was used to inflate the download count artificially.

The deception also extended to VirusTotal, where some malware samples received benign votes and “safe” community comments.

Check Point Research noted that this sentiment manipulation, when combined with already low antivirus detection rates, can mislead both users and automated reputation-based detection systems.

The result does not actually make a file safer, but it makes it look that way, and that is enough.

How the Clipboard Hijacker Actually Works

On Windows, victims download a ZIP and run a file like SniperBot_Premium(Free).exe, which is a .NET loader that silently executes a hidden file called silkebin.exe, the actual Rust-built clipboard hijacker.

It installs itself in a startup folder so it launches automatically on every system boot. The malware monitors clipboard changes and checks whether the copied text matches a cryptocurrency address using regular expressions for Bitcoin, Ethereum, Litecoin, Tron, XRP, Monero, Cardano, Dogecoin, and more.

When a match is detected, it silently replaces the address with one pulled from a built-in list of over 15,500 attacker-controlled wallets.

These wallets are rotated frequently, with used addresses swapped for fresh ones after each completed transaction.

On macOS, victims are instructed to run unlocker.command, which strips macOS security warnings and launches the malicious app automatically.

This version installs a LaunchAgent for persistence and includes a self-healing watchdog loop that continuously rewrites its own files, making removal extremely difficult without killing the active process first.

Users are strongly advised to avoid downloading any tool that promises automated trading gains or gambling shortcuts from unofficial sources.

Always verify each wallet address character by character before sending any cryptocurrency, and never trust a file based solely on its GitHub star count, download figures, or VirusTotal community comments.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.