Cliptoshuffler
Overview
Executive Summary
Cliptoshuffler (often referred to simply as a "Clipper") is a highly specialized and stealthy Trojan engineered specifically to steal cryptocurrency. It operates by continuously monitoring the infected system's clipboard. When it detects a string resembling a cryptocurrency wallet address, it instantly replaces it with a wallet address controlled by the attacker, hijacking the transaction before it is sent.Infection Vector and Technical Capabilities
Clippers are frequently bundled with other malware, distributed via Malspam, hidden inside "cracked" software, or dropped by initial access brokers who have already compromised a system. Once resident in memory, Cliptoshuffler executes its targeted theft routine:- Clipboard Hooking: The malware utilizes Windows APIs (such as `SetClipboardViewer` or polling the clipboard via `GetClipboardData`) to continuously monitor any text copied by the user.
- Pattern Matching: The Trojan contains a list of Regular Expressions (Regex) designed to identify the distinct formats of various cryptocurrency addresses, including Bitcoin (starting with 1, 3, or bc1), Ethereum (starting with 0x), Litecoin, and Monero.
- On-the-Fly Substitution: When a user copies a legitimate recipient address to paste it into their wallet software or an exchange portal, Cliptoshuffler instantly overwrites the clipboard contents with the attacker's corresponding address. If the user fails to double-check the pasted address before authorizing the transaction, the funds are irreversibly sent to the attacker.
Threat Assessment
A Cliptoshuffler infection leads to immediate, irreversible financial loss. Because cryptocurrency transactions cannot be reversed or charged back, the theft is absolute. The malware is designed to be entirely invisible to the user until the moment the transaction is finalized.Remediation and Eradication
- Endpoint Scanning: Utilize an enterprise-grade anti-malware solution to perform a full system scan. Clippers often lack complex obfuscation but hide deep within system processes or as scheduled tasks.
- Transaction Verification Procedures: The most effective defense against clippers is procedural: users must be trained to manually verify the first and last several characters of a cryptocurrency address after pasting it into the destination field and before clicking send.
- Comprehensive Review: The presence of a clipper often indicates a broader compromise. A full forensic review of the endpoint should be conducted to ensure no secondary backdoors or info-stealers were deployed alongside the clipper.
Known aliases
Threat reports may refer to this family under multiple names:
MITRE ATT&CK Techniques
This family has been observed using the following ATT&CK techniques: T1115 T1565.001 T1059
Tactical Mitigations
Based on the techniques used by this family, consider the following defensive strategies:
- T1059: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.
Generated Detections (Boilerplate)
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
YARA Rule
rule MALWARE_WIN_CLIPTOSHUFFLER {
meta:
description = "Detects Cliptoshuffler (trojan)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "cliptoshuffler" ascii wide nocase
$s2 = "trojan.clipper" ascii wide nocase
$s3 = "trojan.cointhief" ascii wide nocase
$s4 = "win32/cliptoshuffler" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Sigma Rule
title: Suspicious Cliptoshuffler Activity
id: e0c2c4facb457d99a53c7b46fee15f5b
status: experimental
description: Detects generic indicators of the cliptoshuffler malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*cliptoshuffler*"
- "*trojan.clipper*"
- "*trojan.cointhief*"
- "*win32/cliptoshuffler*"
condition: selection
level: mediumReferences & External Analysis
- Search "cliptoshuffler" on VirusTotal (External Analysis)
Frequently Asked Questions
How do I remove the Cliptoshuffler Trojan from Windows?
Manual removal of Cliptoshuffler is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
Is Cliptoshuffler a virus or a Trojan?
Cliptoshuffler is classified as a Trojan. Unlike traditional viruses that infect files, modern malware like Cliptoshuffler typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.
What are the main symptoms of a Cliptoshuffler infection?
Symptoms of Cliptoshuffler can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Related Families (Category: trojan)
Explore other malware families in the same category:
Protect Your Network Against Trojans
Want to prevent Cliptoshuffler and similar threats from compromising your organization? Read our comprehensive defensive guide: Banking Trojan Protection.
Machine-readable
Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/cliptoshuffler.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.