{
  "family": "cliptoshuffler",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nCliptoshuffler (often referred to simply as a \"Clipper\") is a highly specialized and stealthy Trojan engineered specifically to steal cryptocurrency. It operates by continuously monitoring the infected system's clipboard. When it detects a string resembling a cryptocurrency wallet address, it instantly replaces it with a wallet address controlled by the attacker, hijacking the transaction before it is sent.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nClippers are frequently bundled with other malware, distributed via Malspam, hidden inside \"cracked\" software, or dropped by initial access brokers who have already compromised a system.\n\nOnce resident in memory, Cliptoshuffler executes its targeted theft routine:\n<ul>\n<li><strong>Clipboard Hooking:</strong> The malware utilizes Windows APIs (such as `SetClipboardViewer` or polling the clipboard via `GetClipboardData`) to continuously monitor any text copied by the user.</li>\n<li><strong>Pattern Matching:</strong> The Trojan contains a list of Regular Expressions (Regex) designed to identify the distinct formats of various cryptocurrency addresses, including Bitcoin (starting with 1, 3, or bc1), Ethereum (starting with 0x), Litecoin, and Monero.</li>\n<li><strong>On-the-Fly Substitution:</strong> When a user copies a legitimate recipient address to paste it into their wallet software or an exchange portal, Cliptoshuffler instantly overwrites the clipboard contents with the attacker's corresponding address. If the user fails to double-check the pasted address before authorizing the transaction, the funds are irreversibly sent to the attacker.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Cliptoshuffler infection leads to immediate, irreversible financial loss. Because cryptocurrency transactions cannot be reversed or charged back, the theft is absolute. The malware is designed to be entirely invisible to the user until the moment the transaction is finalized.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize an enterprise-grade anti-malware solution to perform a full system scan. Clippers often lack complex obfuscation but hide deep within system processes or as scheduled tasks.</li>\n<li><strong>Transaction Verification Procedures:</strong> The most effective defense against clippers is procedural: users must be trained to manually verify the first and last several characters of a cryptocurrency address <em>after</em> pasting it into the destination field and <em>before</em> clicking send.</li>\n<li><strong>Comprehensive Review:</strong> The presence of a clipper often indicates a broader compromise. A full forensic review of the endpoint should be conducted to ensure no secondary backdoors or info-stealers were deployed alongside the clipper.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Clipper",
    "Trojan.CoinThief",
    "Win32/Cliptoshuffler"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1115",
    "T1565.001",
    "T1059"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:04:40Z",
  "type": "Trojan / Clipper",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}