SecuriTricks - cryptocurrency clipper

From package to postinstall payload: Inside the Mastra npm supply chain compromise

Microsoft Threat Intelligence discovered a large-scale npm supply chain attack compromising over 140 packages in the mastra and @mastra scopes. The attack originated from takeover of the ehindero npm maintainer account, which published poisoned package versions introducing easy-day-js, a malicious …

typosquatting

credential-theft

cryptocurrency-clipper

Published: June 18, 2026

Downloadable IOCs: 6

Crypto Clipper uses Tor and worm-like propagation for persistence and control

A Windows-based cryptocurrency clipper has been actively targeting users since February 2026, employing sophisticated techniques to steal digital assets. The malware propagates through malicious shortcut files on USB devices, creating a worm-like infection chain. Once deployed, it utilizes Windows …

remote code execution

clipboard hijacking

wallet theft

usb worm

cryptocurrency clipper

2026-06-18

contebrew

cryptobandits

screenshot exfiltration

seed phrase stealing

tor proxy

Published: June 18, 2026

Downloadable IOCs: 16

Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem

A large-scale operation impersonates open-source and freeware projects to capture search traffic, targeting tools such as Ghidra, dnSpy, and SpiderFoot. The professionally designed sites load CloudFront-hosted JavaScript that converts download button clicks into handoffs to a Traffic Distribution S…

infostealer

click hijacking

traffic distribution system

cryptocurrency clipper

Published: June 3, 2026

Downloadable IOCs: 25

Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

This analysis examines new obfuscation techniques employed by Gremlin stealer malware to conceal malicious payloads within embedded resources. A variant protected by sophisticated commercial packing utility uses instruction virtualization, transforming code into custom bytecode executed by a privat…

infostealer

quasar rat

credential harvesting

guloader

agent tesla

obfuscation techniques

gremlin stealer

session hijacking

telegram exfiltration

2026-05-15

cryptocurrency clipper

discord token theft

lokibot

Published: May 15, 2026

Downloadable IOCs: 12

Tag: cryptocurrency clipper

Attack reports

From package to postinstall payload: Inside the Mastra npm supply chain compromise

Crypto Clipper uses Tor and worm-like propagation for persistence and control

Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem

Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files