Rust Crypto Clipper Malware — Fake GitHub Stars Campaign
Last changed 2026-11-02 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the trust score did not change. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·52DerZ…HFgGSummary
An active malware campaign discovered by Check Point Research in June 2026 distributes a Rust-based cryptocurrency clipboard hijacker for Windows and macOS disguised as crypto trading tools and gambling predictors. The operation manufactured false legitimacy through coordinated fake GitHub star networks, AI-narrated YouTube tutorials, inflated VirusTotal ratings, and a SourceForge page showing over 44,000 downloads, achieving more than 5,000 confirmed genuine GitHub downloads. The clipper silently replaces copied wallet addresses with attacker-controlled addresses drawn from an embedded list of over 15,500 addresses, primarily Bitcoin.
Connected Entities
9 entities · 60 linked investigations- Rust Crypto Clipper Malware — Fake GitHub Stars Campaign→mentioned with→Bitcoin(70%)
- Rust Crypto Clipper Malware — Fake GitHub Stars Campaign→mentioned with→Dogecoin(60%)
- Rust Crypto Clipper Malware — Fake GitHub Stars Campaign→mentioned with→Ethereum(60%)
- Rust Crypto Clipper Malware — Fake GitHub Stars Campaign→mentioned with→Litecoin(60%)
- Rust Crypto Clipper Malware — Fake GitHub Stars Campaign→mentioned with→Cardano(60%)
- Rust Crypto Clipper Malware — Fake GitHub Stars Campaign→mentioned with→Solana(60%)
- Rust Crypto Clipper Malware — Fake GitHub Stars Campaign→mentioned with→Monero(60%)
- Ethereum→mentioned with→Bitcoin(60%)
- Monero→mentioned with→Bitcoin(60%)
- Litecoin→mentioned with→Bitcoin(70%)
- + 10 more
Timeline(7 events)
2019
Threat actor operating under the handle '@JoseCmanXD' first identified as active on a hacking forum. Exact date within 2019 not specified in public reporting.
Check Point ResearchJuly 2020
YouTube channel later used to promote the malware campaign was created. Exact date within July 2020 not specified.
Check Point Research2022
Actor '@JoseCmanXD' posted thread on a hacking forum titled 'BLACKHAT | Bitcoin Stealer | Advanced Builder | Tutorial | Clipper [Address Changer]+Re-Fud method,' sharing a malicious crypto-related tool. Exact date within 2022 not specified.
Check Point Research27 April 2026
Coordinated promotional articles promoting the malicious tools were published simultaneously across multiple legitimate news websites, distributed via EIN Presswire and syndicated to USA TODAY Network partner outlets.
Check Point Research18 June 2026
GBHackers and Infosecurity Magazine publish coverage of the campaign based on Check Point findings.
Infosecurity Magazine19 June 2026
Check Point Research publishes full technical report 'From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker,' disclosing the campaign with indicators of compromise. Help Net Security also publishes coverage.
Check Point Research19 June 2026
The Hacker News and Cybersecurity News publish coverage of the campaign, expanding public awareness of the malicious GitHub accounts, SourceForge page, and YouTube channel.
The Hacker NewsDecision Log
- slot 464360181 · hash BK1drNBpmRVDqEo7iz6nCHnnmdpiHfxkcDza6TomJczG
- slot 464360175 · hash CqtyfMyzxRR13urEcZC4y7EoXR4fRHcPviVjhh26tA2R
- slot 427987108 · hash 94EexPUQxmTwt9cRYNU3KfsDSWY3SFoAVjtKhxwgTZTz
This investigation is cryptographically anchored to the Solana blockchain (3 decisions). 7 of 7 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/21/2026, 5:33:05 PM
last updated: 11/2/2026, 4:25:35 AM
4 viewsavoid.net — verified advice for a post-truth world