ReversingLabs examines how AnimateClipper and Efimer replace copied cryptocurrency wallet addresses, including address-matching methods, evasion features…

Introduction: A Small Clipboard Manipulation Can Cause Permanent Financial Losses Cryptocurrency transactions depend heavily on accurate wallet addresses. Because these addresses are long, complicated strings of characters, most users rely on copying and pasting rather than typing them manually. This convenience creates an opportunity for cybercriminals. Clipboard-monitoring malware can silently replace a legitimate cryptocurrency wallet address with one controlled by an attacker.

Hackers hijacked HBO Max’s official Reddit account to run malicious ads that led users to ClickFix pages and infected Windows and macOS devices with information-stealing malware. The campaign, linked by researchers to PasteSwitch, also pushed fake AI tools, developer software, and cryptocurrency wallet apps to steal credentials and wallet recovery phrases. #HBOMax #PasteSwitch #MacSync #AMOS #AmateraStealer #AnimateClipper #ZigClipper

A compromised verified Reddit account for HBO Max was used for 48 hours to run a massive PasteSwitch ClickFix malvertising campaign, pushing 108 deceptive ads that led users to fake macOS and Windows installers. The operation delivered MacSync, AMOS, Amatera Stealer, and cryptocurrency clippers through cross-platform lures, deceptive TLS tactics, and smart contract-based C2 infrastructure. #HBOMax #PasteSwitch #ClickFix #MacSync #AMOS #AmateraStealer #AnimateClipper #ZigClipper #Reddit

Check Point Research uncovered a large-scale operation that impersonated open-source and freeware projects to capture search traffic through deceptive sites and click-driven redirects. The traffic was funneled through a CloudFront-hosted JavaScript staging layer and TDS chains that ultimately pointed selected users to RemusStealer, AnimateClipper, and the SessionGate framework. #CheckPointResearch #CloudFront #RemusStealer #AnimateClipper #SessionGate

Check Point Research exposed a large-scale campaign that impersonates trusted open-source and freeware projects such as Ghidra, dnSpy, and SpiderFoot to hijack download clicks and route users through a gated Traffic Distribution System. The same infrastructure was used to deliver SessionGate, RemusStealer, and AnimateClipper, showing that the operation mixed traffic monetization with downstream malware delivery. #Ghidra #dnSpy #SpiderFoot #SessionGate #RemusStealer #AnimateClipper

https://www.osintinvestigate.com Cybersecurity researchers have flagged a large-scale operation that impersonates open-source and freeware projects to funnel unsuspecting users through a Traffic Distribution System (TDS) and deliver malware families like Remus Stealer, AnimateClipper, and the SessionGate framework.

Cybersecurity researchers have flagged a large-scale operation that impersonates open-source and freeware projects to funnel unsuspecting users through a Traffic Distribution System (TDS) and deliver malware families like Remus Stealer, AnimateClipper, and the SessionGate framework. "The sites are well-designed and often look like legitimate project portals at a glance, sometimes referencing

A widespread malicious campaign has been uncovered deploying dozens of spoofed websites designed to impersonate popular Windows utilities, developer toolkits,

Cybersecurity researchers have flagged a large-scale operation that impersonates open-source and freeware projects to funnel unsuspecting users through a Traffic Distribution System (TDS) and deliver malware families like Remus Stealer, AnimateClipper, and the SessionGate framework. "The sites are well-designed and often look like legitimate project portals at a glance, sometimes referencing

偽装サイト100件超が信頼性の高いセキュリティツールを模倣SessionGate、RemusStealer、AnimateClipperを配布主目的はトラフィックによる収益化信頼性の高いオープンソースセキュリティツールを偽装し、開発者やセキュリティ研究者から広告収益を騙し取るとともにマルウェアを配布する、大

A large-scale campaign impersonates open-source and freeware project portals to redirect users through a gated TDS and deliver malware.