Home > News

New Malware Steals Cryptocurrency by Lifting from Your Clipboard

By Laura Tucker
New Malware Steals Cryptocurrency by Lifting from Your Clipboard Featured Image

For decades the clipboard has been an everyday occurrence of the computing experience, whether being used on Windows, Mac, or Linux. But now attackers have found their way to your clipboard so that they can insert malware that will steal your cryptocurrency.

This will make you think twice the next time you copy and paste sensitive information, especially cryptocurrency. The new use for malware will replace the address of your cryptocurrency transaction with the address of the attacker’s wallet.

The Crime

The ComboJack malware works on multiple currencies by relying on you not checking the wallet you’re sending your transaction to. There are many existing spam emails that were used to distribute the malware, and the shear number of emails shows that the attackers are being successful with their endeavor.

But don’t think you’re safe just because you don’t use Bitcoin, as non-cryptocurrency digital payment systems, such as WebMoney and Yandex Money, are being targeted as well.

news-clipboard-malware-coins

Researchers at Palo Alto Networks happened onto this malware campaign while watching an email phishing campaign that was targeting users in both America and Japan.

The emails don’t use the victims’ names yet claim a passport has been misplaced, instructing the reader of the email to open a document that contains a scanned version of it to “check if you know the owner.”

Once the email recipient opens the file, they’re told to allow an embedded file to run so that they can view the document. If they follow along and allow the file to run, it will enable an embedded RTF file to inject code and run PowerShell commands that will be used to download ComboJack and execute it.

ComboJack will then get to work using the built-in Windows tool, attrib.exe, and that will allow it to hide itself from the email recipient and also execute processes that have high-level privileges.

It will then start a loop where it will check the clipboard content every half second to see if the user has copied information about cryptocurrencies. If it finds that, it will replace the present address with an address connected to the attacker, hoping the victim won’t notice.

Beyond this Exploitation

news-clipboard-malware-clipboard

Beyond an organization trying to steal cryptocurrency, it certainly means that anything could potentially be stolen from your clipboard. And many of us use the clipboard function for many things.

The question is if you use the clipboard function for anything that would be potentially harmful if it was stolen, such as passwords. Sometimes passwords are emailed to you to set up an account, and they can be so long and filled with numbers and letters that the easiest solution is to copy and paste them.

Of course, it would require someone to be sitting on the other end constantly checking your clipboard for password information and to know where it will go, so it’s quite a stretch. But now we know that this could potentially happen.

The important thing to know is that the clipboard is a vulnerability, so it’s best to keep that in mind when you’re copying and pasting.

Possible Solutions

This particular vulnerability was patched by Microsoft last September, so the first line of defense is to keep your operating system up to date. Additionally, you need to be careful of emails from unknown organizations that ask you to download attachments. Hopefully, these are things you’re already doing anyway.

Is this type of vulnerability something you’re worried about? Would you have ever imagined that your clipboard could be exploited? Let us know your thoughts on this in the comments.

Subscribe to our newsletter!

Our latest tutorials delivered straight to your inbox

Laura Tucker Avatar
Laura Tucker
Laura has spent more than 20 years writing news, reviews, and op-eds, with the majority of those years as an editor as well. She has exclusively used Apple products for the past 35 years. In addition to writing and editing at MTE, she also runs the site’s sponsored review program.

Read next

When the SS Great Eastern laid the first working transatlantic telegraph cable in 1866, a message that had taken ten days by steamship suddenly crossed the ocean in minutes, and the financial markets of London and New York were forced, within a single trading week, to invent the modern concept of synchronised global price.
From below of blue starry sky over radio telescope and trees with leaves
The Big Ear telescope was scanning at 1420.4056 megahertz on the night of 15 August 1977, the exact frequency at which hydrogen atoms vibrate across the universe, because Giuseppe Cocconi and Philip Morrison had argued years earlier that any species trying to be found would broadcast on that channel — and then, for 72 seconds, something did.
In 2016, archaeologists dated two rings of snapped stalagmites in France’s Bruniquel Cave to 176,500 years ago, evidence that Neanderthals had walked 336 metres into darkness with fire and built architecture deep underground long before modern humans reached Europe
Otto von Bismarck was 74 when Germany adopted the world’s first national old-age social insurance program in 1889, setting the pension age at 70 after years of fighting socialists with bans, laws, and a promise few workers would live long enough to use
When cosmonaut Valeri Polyakov stepped out of his Soyuz capsule in March 1995 after 437 consecutive days aboard Mir, doctors recorded him at several centimetres above his pre-flight height, and his spine had become so unaccustomed to gravity that the recovery team carried him to a chair rather than risk the compression of letting him walk.
When Bell Labs engineer Karl Jansky pointed a rotating antenna at the sky in 1932 looking for sources of transatlantic radio static, he kept picking up a faint hiss that peaked every 23 hours and 56 minutes, and he eventually realized he had become the first human to hear the center of the Milky Way.
A contemplative scene with two scientists in a vintage laboratory setting.
When Harvard astronomer Cecilia Payne submitted her 1925 doctoral thesis arguing that the Sun was made almost entirely of hydrogen, the field’s senior figure Henry Norris Russell talked her into adding a line calling the result ‘almost certainly not real,’ and then published the same conclusion himself four years later to widespread acclaim.
When seismic waves from the Chicxulub impact reached what is now North Dakota roughly ten minutes after the asteroid struck, they appear to have triggered a ten-metre standing wave in an inland river that flung fish onto the bank and buried them under glass beads still falling from the sky.