JoseCmanXD Rust Crypto Clipboard Hijacker ("silke"/"silkebin") Distributed via Fake Reputation Across GitHub, SourceForge, YouTube and VirusTotal
JoseCmanXD Rust Crypto Clipboard Hijacker (TL-2026-0840), also tracked as silke clipper, is a high-severity malware campaign, first published 2026-06-17. It is attributed to JoseCmanXD with medium confidence, affects Microsoft Windows, maps to 17 MITRE ATT&CK techniques (T1036.005, T1036.008, T1059.004), and is covered by 9 detection rules and 41 indicators of compromise.
Key facts for TL-2026-0840
- Threat ID
- TL-2026-0840
- Also known as
- silke clipper, silkebin, From Stars to Upvotes campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-17
- Last reviewed
- 2026-06-17
- Attribution
- JoseCmanXD
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, individuals, online-gambling, finance
- Target regions
- Global, Russia, Pakistan, India
- Detection rules
- 9
- Indicators of compromise
- 41
Malware and tooling in JoseCmanXD Rust Crypto Clipboard Hijacker
Malware and tooling: Silkebin
A financially-motivated actor known as @JoseCmanXD distributes a cross-platform Rust clipboard hijacker (clipper) disguised as crypto trading bots and game predictors, building fake reputation through coordinated 'Ghost Networks' across GitHub, SourceForge, YouTube, VirusTotal, BitcoinTalk and compromised/paid news outlets. The malware persists on Windows and macOS and silently swaps cryptocurrency wallet addresses copied to the clipboard with attacker-controlled wallets to redirect funds.
How JoseCmanXD Rust Crypto Clipboard Hijacker works
Check Point Research disclosed (June 17, 2026) an active, financially-motivated campaign operated by an actor using the Telegram/WordPress handle @JoseCmanXD that distributes a cross-platform Rust-based clipboard hijacker (a 'clipper'). The malware is delivered under the guise of cryptocurrency trading tools and gambling 'predictor' applications — Solana/Pump.fun sniper bots, Aviator Predictor, crash-game predictors and DEX trading automation — targeting users seeking shortcuts and quick crypto profits.
On Windows, a simple .NET loader executes an embedded Rust binary located at src/config/silkebin.exe. The Rust clipper copies itself to %APPDATA%\silke\silke.exe and establishes persistence via a Startup-folder shortcut. It registers a clipboard listener (AddClipboardFormatListener) and continuously inspects clipboard contents with embedded regular expressions for more than a dozen cryptocurrency address formats — Bitcoin (Bech32, legacy P2PKH, P2SH), Ethereum/EVM, Litecoin, TRON, XRP, Cardano, Monero, Dogecoin, Bitcoin Cash, Bitcoin Gold, Stellar and Zcash. When a wallet address is detected it is replaced (via OpenClipboard/EmptyClipboard/SetClipboardData) with an attacker-controlled address. The Windows variant ships a large embedded wallet database of roughly 15,000+ attacker Bitcoin addresses (~5,000 each of Bech32, legacy and P2SH) plus ~500 Ethereum addresses and entries for 15+ additional currencies, chosen to closely resemble the victim's intended recipient.
On macOS, a loader runs unlocker.command which bypasses Gatekeeper by stripping the quarantine attribute with 'xattr -cr' before launching the lure application. The macOS Rust executable monitors the pasteboard for wallet-like strings and persists by writing a shell script to ~/launch.sh and installing a LaunchAgent property list at ~/Library/LaunchAgents/com.example..plist, causing launchd to silently re-execute the binary on every login. A 30-second watchdog loop continuously re-writes both files and re-clones the binary to survive removal. The macOS variant uses a single attacker wallet per currency rather than a large database.
The campaign's defining characteristic is large-scale reputation manipulation. A WordPress phishing site acts as the central hub linking to all tools. The actor operates at least six GitHub accounts (Decryptor-j, crash-predictor1, roblox-script1, hack-scripts, stake-mines and others) whose repositories carry inflated stars (e.g. 146 stars, 62 forks) and have accrued ~5,000+ downloads (1,250+ for the macOS Aviator Predictor). Multiple SourceForge projects show 44,485 downloads, of which ~37,460 originate from suspicious Android devices concentrated in Pakistan and India, indicating download-farm inflation. The YouTube channel uses AI-generated narration and shows view spikes and positive engagement driven by Ghost Accounts. On VirusTotal, sock-puppet accounts post benign community comments and cast 'harmless' votes to disguise clearly malicious samples. Coordinated 'news' advertisements promoting the tools were published simultaneously across multiple outlets on April 27, 2026.
The actor has been active on hacking forums since 2019 and in 2022 advertised a tool titled 'BLACKHAT | Bitcoin Stealer | Advanced Builder | Tutorial | Clipper [Address Changer] + Re-Fud method', with early Russian-language YouTube content later shifting to English for a global audience. Blockchain analysis shows the attacker wallets received multiple transactions yielding notable illicit gains, and wallets are rotated frequently — once a malicious transaction completes the used wallet is swapped for a fresh 'clean' one. The malware is updated every few weeks, indicating an ongoing, profitable operation. No CVE is involved; this is commodity malware leveraging social-engineering supply-chain abuse rather than a software vulnerability.
MITRE ATT&CK techniques used in TL-2026-0840
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1036.008 Masquerade File Type; T1070.009 Clear Persistence
Execution
T1059.004 Unix Shell; T1204.001 Malicious Link; T1204.002 Malicious File
Collection
Persistence
T1543.001 Launch Agent; T1547.001 Registry Run Keys / Startup Folder
defense-impairment
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1583.006 Web Services; T1585.001 Social Media Accounts; T1587.001 Malware; T1608.001 Upload Malware
Impact
Affected products and versions in JoseCmanXD Rust Crypto Clipboard Hijacker
- Microsoft — Windows
Vulnerable versions: x86; x64 - Apple — macOS
Vulnerable versions: Intel; Apple Silicon
Remediation for JoseCmanXD Rust Crypto Clipboard Hijacker
Immediate actions
- Treat any copied cryptocurrency address as untrusted: always verify the full destination address character-by-character (especially first/last 6 characters) on the signing device before approving a transaction.
- Add the attacker-controlled wallet addresses in this report to transaction-monitoring/blocklists where supported.
- Hunt for and remove %APPDATA%\silke\silke.exe and any Startup-folder shortcut pointing to it on Windows hosts.
- On macOS, remove ~/Library/LaunchAgents/com.example..plist, ~/launch.sh, and cloned clipper binaries; unload the LaunchAgent with launchctl.
- Block the SHA-256 hashes listed as IOCs in EDR/AV.
Workarounds
- Enable clipboard-clearing utilities and avoid copy-paste of wallet addresses; type or scan addresses where feasible.
- Keep macOS Gatekeeper enabled and never run scripts (e.g. unlocker.command) that disable quarantine.
Longer-term hardening
- Deploy EDR with behavioral detection for clipboard-listener registration and rapid clipboard rewrites.
- Use hardware wallets and address allow-listing / QR-based address transfer to defeat clipboard substitution.
- Restrict execution of unsigned binaries from %APPDATA% and user home directories via application control (WDAC/AppLocker, macOS notarization enforcement).
- Educate users that 'predictor', 'sniper bot' and game-cheat tools advertised via inflated GitHub/SourceForge/YouTube metrics are a common malware lure.
Timeline of JoseCmanXD Rust Crypto Clipboard Hijacker
- Threat actor @JoseCmanXD active on hacking forums; account creation traced to at least 2019.
- Actor advertises 'BLACKHAT | Bitcoin Stealer | Advanced Builder | Tutorial | Clipper [Address Changer] + Re-Fud method' on a hacking forum.
- YouTube channel promotes lure tools; early content targets a Russian-speaking audience before shifting to English for a global reach.
- Coordinated 'news' advertisements promoting the malicious tools published simultaneously across multiple (paid or compromised) outlets.
- Researchers note the clipper is updated every few weeks, indicating an ongoing, actively maintained and profitable operation.
- Blockchain analysis confirms attacker-controlled wallets received multiple transactions with notable illicit gains; wallets rotated to 'clean' addresses after each successful theft.
- A WordPress phishing site is identified as the central hub linking to all lure tools across GitHub, SourceForge, YouTube and BitcoinTalk.
- VirusTotal sock-puppet accounts observed posting benign community comments and casting 'harmless' votes on the malicious samples to disguise their nature.
- macOS Aviator Predictor lure accrues 1,250+ downloads; at least six attacker-operated GitHub accounts (Decryptor-j, crash-predictor1, roblox-script1, hack-scripts, stake-mines and others) host repos with inflated stars/forks (e.g. 146 stars, 62 forks).
- SourceForge projects show 44,485 downloads (~37,460 from suspicious Android devices in Pakistan/India); GitHub repos show ~5,000+ downloads with inflated stars/forks.
- Check Point Research publishes 'From Stars to Upvotes', detailing the Rust clipper, fake-reputation Ghost Networks, IOCs and attacker wallets.
Sources cited for JoseCmanXD Rust Crypto Clipboard Hijacker
- From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker
- MITRE ATT&CK T1115 — Clipboard Data
- MITRE ATT&CK T1547.001 — Registry Run Keys / Startup Folder
- MITRE ATT&CK T1543.001 — Create or Modify System Process: Launch Agent
- MITRE ATT&CK T1553.001 — Subvert Trust Controls: Gatekeeper Bypass
- Cryptocurrency Miner and Clipper Malware Spread via SourceForge Cracked Software Listings
- New clipboard hijacker replaces crypto wallet addresses with lookalikes
Threats related to JoseCmanXD Rust Crypto Clipboard Hijacker
- Fake OpenAI Codex Download Pages on Google Sites Deliver ClickFix macOS Stealer Tied to Atomic Stealer (AMOS) Infrastructure
- SHub Stealer "Reaper" — macOS Infostealer Using applescript:// URL-Scheme Delivery, Filegrabber Module, and Google-Masquerading LaunchAgent Backdoor
- ClickFix Attacks Deliver Go-Based macOS Infostealer Targeting Crypto Wallets and Keychain Data
- Operation ASTERIX: AI-Assisted Crypto Wallet Phishing/Vishing Fraud Pipeline Abuses Claude Code and Kimi
- Fake BlueWallet macOS Stealer — AppleScript Dropper Delivers Infostealer with Clipboard Crypto-Address Hijack and Telegram C2
Detection coverage for TL-2026-0840
As of 2026-06-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0840 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.