{"id":26320,"date":"2026-10-29T11:00:12","date_gmt":"2026-10-29T19:00:12","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/10\/29\/threat-researchers-notebook-how-attackers-redirect-crypto-payments\/"},"modified":"2026-10-29T11:00:12","modified_gmt":"2026-10-29T19:00:12","slug":"threat-researchers-notebook-how-attackers-redirect-crypto-payments","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2026\/10\/29\/threat-researchers-notebook-how-attackers-redirect-crypto-payments\/","title":{"rendered":"Threat Researcher\u2019s Notebook: How Attackers Redirect Crypto Payments"},"content":{"rendered":"
\n
\n

Summary<\/h2>\n

Cryptocurrency is being used every day to facilitate a variety of transactions. It\u2019s unlike the usual banking systems, having its own unique strengths and weaknesses. Attackers have made specialized malware to redirect normal transactions to wallets they control in order to steal money, referred to as \u201cClipbankers<\/span><\/a>\u201d. Due to the nature of cryptocurrency, these transactions are irreversible. ReversingLabs investigated two malware families of this nature, digging into how they work. This blog discusses the general trend of Clipbanker malware, why they can be successful, what specific samples look like, and how to avoid them.<\/p>\n

Introduction<\/h2>\n

There is a type of malware designed with one main goal in mind, to replace copied cryptowallet addresses with ones that are controlled by the attacker. For the sake of consistency, this blog will use the term \u201cClipbanker<\/span><\/a>\u201d as a way to refer to the general group of malware with this specific behavior. More sophisticated variations match the replacement address to a similar attack controlled one, lowering the chance of detection.\u00a0 While Clipbankers are most known for their ability to replace intended wallet addresses with attacker-controlled addresses, they also often come with other malicious features. They can generally monitor and exfiltrate data in the clipboard, or be leveraged for other infostealing purposes.\u00a0<\/p>\n

The Psychology and Systems Behind Clipbankers<\/h2>\n

Three things combine to make this type of malware effective. First, is the innate trust in the clipboard. Most people regularly use the copy and paste function on their devices. It\u2019s automatic and second nature, and usually they assume that unless something is glaringly wrong, that what they had intended to copy is what actually ends up pasted. In a lot of cases, it\u2019s pretty immediately recognizable when something doesn\u2019t copy and paste correctly, since people can confirm their copy-paste for consistency with a quick glance. This is where the second element that plays in the attackers favor sets in. Crypto wallet addresses are long strings of random characters, which are much harder to scan for discrepancies. When copy-pasting a physical address, an incorrect street name is glaringly obvious. However, a long string of numbers is a long string of numbers, they all look the same. Some attackers program their malware to provide a malicious address that matches the first or last numbers of the original address, so cursory checks of the most noticeable numbers can be fooled. Another note here is that even if the user noticed the discrepancy, they may not realize the issue is due to malware, and may assign it to more benign reasoning. While they may catch the issue and figure out how to correct it, they’re still vulnerable.<\/p>\n

The cognitive biases in the user are a boon to the attacker, and there is a third factor in the attacker’s favor. Crypto transactions are irreversible<\/span><\/a>. Crypto differs from traditional banking by being on the blockchain. The blockchain is a cryptographic solution that involves many machines maintaining ledgers<\/span><\/a> that store transaction records, storing them into blocks. Since blocks contain the hash of the previous block, tampering with these records is not possible. \u201cImutable\u201d is the word used to describe this unchanging nature. In addition to the structure of the blockchain, crypto is decentralized. There is no authority to complain to get transactions reversed. There is little recourse for those who misplace their payments. There are some legitimate uses to this system, such as mitigating chargeback scams or similar malpractice. Unfortunately, it also makes cryptocurrency appealing to hackers.<\/p>\n

With these factors in mind, it\u2019s quite obvious why attackers are gravitating towards this as a way to a payday. It\u2019s easy to catch someone vulnerable off guard and route their legitimate activity to an illegitimate source. Once it\u2019s done, it\u2019s done, and the attacker can make off with their prize. That\u2019s why attackers build speciality malware to replace addresses. There are multiple things in their favor if they can redirect these payments without being detected, so they make subtle and evasive malware to accomplish this goal.<\/p>\n

Examples\u00a0<\/h2>\n

Recently, ReversingLabs has been looking into two malware families of this type: AnimateClipper and Efimer. AnimateClipper<\/span><\/a>, also called ZigClipper, is the newer of the two. It is classified differently depending on the source, but predominately the AnimateClipper title is used. Efimer is an older family, notable for the specific ways it matches the intended recipient address with the attacker controlled ones. Efimer matches leading or trailing digits, depending on the address type. Both became inactive soon after RL completed this research, but they still serve as valuable examples of ClipBanker malware.<\/p>\n

\n