Threat reportMalwareTL-2026-0840
JoseCmanXD Rust Crypto Clipboard Hijacker ("silke"/"silkebin") Distributed via Fake Reputation Across GitHub, SourceForge, YouTube and VirusTotal
A financially-motivated actor known as @JoseCmanXD distributes a cross-platform Rust clipboard hijacker (clipper) disguised as crypto trading bots and game predictors, building fake reputation through coordinated 'Ghost Networks' across GitHub, SourceForge, YouTube, VirusTotal, BitcoinTalk and compromised/paid news outlets. The malware persists on Windows and macOS and silently swaps cryptocurrency wallet addresses copied to the clipboard with attacker-controlled wallets to redirect funds.
Key facts for JoseCmanXD silke clipper
| Identifiers | TL-2026-0840 |
|---|---|
| Also known as | silke clipper, silkebin, From Stars to Upvotes campaign |
| Severity | HIGH |
| Exploitation status | Exploited in the wild |
| Affected products | Microsoft Windows; Apple macOS |
| Attribution | JoseCmanXD (medium confidence) |
| Malware | Silkebin |
| MITRE ATT&CK techniques | T1036.005 Match Legitimate Resource Name or Location, T1036.008 Masquerade File Type, T1059.004 Unix Shell, T1070.009 Clear Persistence, T1115 Clipboard Data, T1204.001 Malicious Link, T1204.002 Malicious File, T1543.001 Launch Agent, T1547.001 Registry Run Keys / Startup Folder, T1553.001 Gatekeeper Bypass, T1566.002 Spearphishing Link, T1583 Acquire Infrastructure and 5 more in the attack flow |
| Motivation | FINANCIAL |
| Target sectors | cryptocurrency, individuals, online-gambling, finance |
| Target regions | Global, Russia, Pakistan, India |
| Detection rules | 9 (1 shown free) |
| Sources | 7 cited sources |
Detection coverage for JoseCmanXD silke clipper
As of 2026-06-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0840 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: silke Clipper — .NET Loader Executes Unsigned Binary from %APPDATA%\silke (Exploitation)
Detects the initial-execution footprint of the JoseCmanXD 'silke' Rust clipper on Windows: a .NET loader (lure trading-bot/predictor app) spawning or dropping the embedded Rust clipper (silkebin.exe) and the self-copy to %APPDATA%\silke\silke.exe. An unsigned PE written to and executed from a user-writable Roaming path under the 'silke' folder is the earliest reliable host signal of infection (masquerading as a legitimate app). Fires on Sysmon Process Create (EventCode=1) where the image path resolves into the silke working directory, or where a known-loader parent launches a child from AppData\Roaming.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1204.002, T1036.005
- Data sources: sysmon, windows_security, edr_process_telemetry
- Severity: critical
- Confidence: high
Splunk SPL
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval img=lower(Image), parent=lower(ParentImage), cmd=lower(CommandLine)
| where like(img,"%\\appdata\\roaming\\silke\\%") OR like(img,"%\\silkebin.exe") OR (like(parent,"%\\appdata\\local\\temp\\%") AND like(img,"%\\appdata\\roaming\\%\\silke%.exe")) OR like(cmd,"%src\\config\\silkebin.exe%")
| eval unsigned=if(Signed="false" OR isnull(Signed),1,0)
| stats count min(_time) as firstSeen max(_time) as lastSeen values(Image) as images values(ParentImage) as parents values(CommandLine) as cmdlines values(Hashes) as hashes by host, User
| convert ctime(firstSeen) ctime(lastSeen)
| where count > 0Microsoft KQL
// Sentinel — silke .NET loader executing unsigned clipper from %APPDATA%\silke
DeviceProcessEvents
| where Timestamp > ago(24h)
| extend FolderPathLower = tolower(FolderPath), InitFolderLower = tolower(InitiatingProcessFolderPath)
| where FolderPathLower has "\\appdata\\roaming\\silke\\" or FileName =~ "silkebin.exe" or (InitFolderLower has "\\appdata\\local\\temp\\" and FolderPathLower has "\\appdata\\roaming\\" and FileName endswith ".exe")
| where isempty(ProcessVersionInfoCompanyName) or ProcessVersionInfoOriginalFileName == ""
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, SHA256
| order by Timestamp descSigma
title: silke Clipper Unsigned Binary Execution from APPDATA\silke
id: 0a4e1c2e-1b9a-4d77-9a51-1c0840a00001
status: experimental
description: Detects execution of the silke Rust clipper (silkebin.exe / silke.exe) from the user-writable %APPDATA%\silke directory, typically launched by a .NET lure loader.
references:
- https://research.checkpoint.com/2026/from-stars-to-upvotes-fake-reputation-fueling-a-crypto-clipboard-hijacker/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/17
tags:
- attack.execution
- attack.t1204.002
- attack.defense_evasion
- attack.t1036.005
logsource:
product: windows
category: process_creation
detection:
selection_path:
Image|contains: '\AppData\Roaming\silke\'
Image|endswith: '.exe'
selection_name:
Image|endswith: '\silkebin.exe'
condition: selection_path or selection_name
falsepositives:
- Unlikely; no known legitimate software installs to %APPDATA%\silke. Investigate any hit.
level: highKnown false positives:
- No known legitimate software installs to %APPDATA%\silke; treat any match as suspicious.
- Security tooling or analysts intentionally detonating the sample in a sandbox.
Tuning notes: Tighten by correlating with the known clipper SHA-256 IOCs (e.g. 5518942d9d21794aaeff41a01b88606a96659fc329b481a2f0946d8163ab4d61). If Sysmon does not populate the Signed field reliably, drop the unsigned filter and rely on the path/name selector. Add an allowlist for approved AppData-resident apps if your environment legitimately runs any.
- silke Clipper — macOS Gatekeeper Bypass via xattr Quarantine Strip (Exploitation) · unlock with TL Creds
- silke Clipper — macOS LaunchAgent + [indicator] Watchdog Persistence (Post-Exploitation) · unlock with TL Creds
- silke Clipper — macOS Pasteboard Monitor + Cloned-Binary Self-Heal (C2/Impact) · unlock with TL Creds
- silke Clipper — Unsigned Self-Copy Written to %APPDATA%\silke (Exploitation) · unlock with TL Creds
- silke Clipper — macOS LaunchAgent Persistence Plist Drop (Post-Exploitation) · unlock with TL Creds
- silke Clipper — Outbound Crypto Transaction to Known Attacker Wallet (C2/Impact) · unlock with TL Creds
- silke Clipper — Startup-Folder Shortcut Persistence to %APPDATA% Binary (Post-Exploitation) · unlock with TL Creds
- silke Clipper — Clipboard-Listener Registration + Rapid Wallet Rewrites (C2/Impact) · unlock with TL Creds
Indicators of compromise for JoseCmanXD silke clipper
As of 2026-06-17, Threadlinqs Intelligence tracks 41 indicators of compromise for TL-2026-0840.
Sample indicators (3 of 41)
- File hash:
5518942d9d21794aaeff41a01b88606a96659fc329b481a2f0946d8163ab4d61 - File hash:
33c86ecfc324de3af97150bd009aba7925a6ba7a0842e127e94cf351013c0fe6 - File hash:
7a7ad4ae347a3f99f3773a113d9f70ecfa967100c96e8275bd1df833caee68d1
Defanged, TLP:CLEAR. Full set of 41 indicators: unlock with TL Creds.
How JoseCmanXD silke clipper works
Check Point Research disclosed (June 17, 2026) an active, financially-motivated campaign operated by an actor using the Telegram/WordPress handle @JoseCmanXD that distributes a cross-platform Rust-based clipboard hijacker (a 'clipper'). The malware is delivered under the guise of cryptocurrency trading tools and gambling 'predictor' applications — Solana/Pump.fun sniper bots, Aviator Predictor, crash-game predictors and DEX trading automation — targeting users seeking shortcuts and quick crypto profits.
On Windows, a simple .NET loader executes an embedded Rust binary located at src/config/silkebin.exe. The Rust clipper copies itself to %APPDATA%\silke\silke.exe and establishes persistence via a Startup-folder shortcut. It registers a clipboard listener (AddClipboardFormatListener) and continuously inspects clipboard contents with embedded regular expressions for more than a dozen cryptocurrency address formats — Bitcoin (Bech32, legacy P2PKH, P2SH), Ethereum/EVM, Litecoin, TRON, XRP, Cardano, Monero, Dogecoin, Bitcoin Cash, Bitcoin Gold, Stellar and Zcash. When a wallet address is detected it is replaced (via OpenClipboard/EmptyClipboard/SetClipboardData) with an attacker-controlled address. The Windows variant ships a large embedded wallet database of roughly 15,000+ attacker Bitcoin addresses (~5,000 each of Bech32, legacy and P2SH) plus ~500 Ethereum addresses and entries for 15+ additional currencies, chosen to closely resemble the victim's intended recipient.
On macOS, a loader runs unlocker.command which bypasses Gatekeeper by stripping the quarantine attribute with 'xattr -cr' before launching the lure application. The macOS Rust executable monitors the pasteboard for wallet-like strings and persists by writing a shell script to ~/launch.sh and installing a LaunchAgent property list at ~/Library/LaunchAgents/com.example..plist, causing launchd to silently re-execute the binary on every login. A 30-second watchdog loop continuously re-writes both files and re-clones the binary to survive removal. The macOS variant uses a single attacker wallet per currency rather than a large database.
The campaign's defining characteristic is large-scale reputation manipulation. A WordPress phishing site acts as the central hub linking to all tools. The actor operates at least six GitHub accounts (Decryptor-j, crash-predictor1, roblox-script1, hack-scripts, stake-mines and others) whose repositories carry inflated stars (e.g. 146 stars, 62 forks) and have accrued ~5,000+ downloads (1,250+ for the macOS Aviator Predictor). Multiple SourceForge projects show 44,485 downloads, of which ~37,460 originate from suspicious Android devices concentrated in Pakistan and India, indicating download-farm inflation. The YouTube channel uses AI-generated narration and shows view spikes and positive engagement driven by Ghost Accounts. On VirusTotal, sock-puppet accounts post benign community comments and cast 'harmless' votes to disguise clearly malicious samples. Coordinated 'news' advertisements promoting the tools were published simultaneously across multiple outlets on April 27, 2026.
The actor has been active on hacking forums since 2019 and in 2022 advertised a tool titled 'BLACKHAT | Bitcoin Stealer | Advanced Builder | Tutorial | Clipper [Address Changer] + Re-Fud method', with early Russian-language YouTube content later shifting to English for a global audience. Blockchain analysis shows the attacker wallets received multiple transactions yielding notable illicit gains, and wallets are rotated frequently — once a malicious transaction completes the used wallet is swapped for a fresh 'clean' one. The malware is updated every few weeks, indicating an ongoing, profitable operation. No CVE is involved; this is commodity malware leveraging social-engineering supply-chain abuse rather than a software vulnerability.
MITRE ATT&CK techniques by tactic:
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1036.008 Masquerade File Type; T1070.009 Clear Persistence
Execution
T1059.004 Unix Shell; T1204.001 Malicious Link; T1204.002 Malicious File
Collection
Persistence
T1543.001 Launch Agent; T1547.001 Registry Run Keys / Startup Folder
defense-impairment
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1583.006 Web Services; T1585.001 Social Media Accounts; T1587.001 Malware; T1608.001 Upload Malware
Impact
Remediation for JoseCmanXD silke clipper
Immediate actions
- Treat any copied cryptocurrency address as untrusted: always verify the full destination address character-by-character (especially first/last 6 characters) on the signing device before approving a transaction.
- Add the attacker-controlled wallet addresses in this report to transaction-monitoring/blocklists where supported.
- Hunt for and remove %APPDATA%\silke\silke.exe and any Startup-folder shortcut pointing to it on Windows hosts.
- On macOS, remove ~/Library/LaunchAgents/com.example..plist, ~/launch.sh, and cloned clipper binaries; unload the LaunchAgent with launchctl.
- Block the SHA-256 hashes listed as IOCs in EDR/AV.
Workarounds
- Enable clipboard-clearing utilities and avoid copy-paste of wallet addresses; type or scan addresses where feasible.
- Keep macOS Gatekeeper enabled and never run scripts (e.g. unlocker.command) that disable quarantine.
Longer-term hardening
- Deploy EDR with behavioral detection for clipboard-listener registration and rapid clipboard rewrites.
- Use hardware wallets and address allow-listing / QR-based address transfer to defeat clipboard substitution.
- Restrict execution of unsigned binaries from %APPDATA% and user home directories via application control (WDAC/AppLocker, macOS notarization enforcement).
- Educate users that 'predictor', 'sniper bot' and game-cheat tools advertised via inflated GitHub/SourceForge/YouTube metrics are a common malware lure.
Affected and fixed versions
Timeline of JoseCmanXD silke clipper
- Threat actor locked-ioc-37 active on hacking forums; account creation traced to at least 2019.
- Actor advertises 'BLACKHAT | Bitcoin Stealer | Advanced Builder | Tutorial | Clipper [Address Changer] + Re-Fud method' on a hacking forum.
- YouTube channel promotes lure tools; early content targets a Russian-speaking audience before shifting to English for a global reach.
- Coordinated 'news' advertisements promoting the malicious tools published simultaneously across multiple (paid or compromised) outlets.
- Researchers note the clipper is updated every few weeks, indicating an ongoing, actively maintained and profitable operation.
- Blockchain analysis confirms attacker-controlled wallets received multiple transactions with notable illicit gains; wallets rotated to 'clean' addresses after each successful theft.
- A WordPress phishing site is identified as the central hub linking to all lure tools across GitHub, SourceForge, YouTube and BitcoinTalk.
- VirusTotal sock-puppet accounts observed posting benign community comments and casting 'harmless' votes on the malicious samples to disguise their nature.
- macOS Aviator Predictor lure accrues 1,250+ downloads; at least six attacker-operated GitHub accounts (locked-ioc-38, locked-ioc-33, locked-ioc-34, locked-ioc-35, locked-ioc-39 and others) host repos with inflated stars/forks (e.g. 146 stars, 62 forks).
- SourceForge projects show 44,485 downloads (~37,460 from suspicious Android devices in Pakistan/India); GitHub repos show ~5,000+ downloads with inflated stars/forks.
- Check Point Research publishes 'From Stars to Upvotes', detailing the Rust clipper, fake-reputation Ghost Networks, IOCs and attacker wallets.
Sources cited for JoseCmanXD silke clipper
- From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker Check Point Research · Research · 2026-06-17
- MITRE ATT&CK T1115 — Clipboard Data MITRE · Research · 2026-06-17
- MITRE ATT&CK T1547.001 — Registry Run Keys / Startup Folder MITRE · Research · 2026-06-17
- MITRE ATT&CK T1543.001 — Create or Modify System Process: Launch Agent MITRE · Research · 2026-06-17
- MITRE ATT&CK T1553.001 — Subvert Trust Controls: Gatekeeper Bypass MITRE · Research · 2026-06-17
- Cryptocurrency Miner and Clipper Malware Spread via SourceForge Cracked Software Listings The Hacker News · News · 2025-04-08
- New clipboard hijacker replaces crypto wallet addresses with lookalikes BleepingComputer · News · 2024-03-01
Previous and next in malware
Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated —.
