# JoseCmanXD Rust Crypto Clipboard Hijacker ("silke"/"silkebin") Distributed via Fake Reputation Across GitHub, SourceForge, YouTube and VirusTotal

> A financially-motivated actor known as @JoseCmanXD distributes a cross-platform Rust clipboard hijacker (clipper) disguised as crypto trading bots and game predictors, building fake reputation through coordinated 'Ghost Networks' across GitHub, SourceForge, YouTube, VirusTotal, BitcoinTalk and compromised/paid news outlets. The malware persists on Windows and macOS and silently swaps cryptocurrency wallet addresses copied to the clipboard with attacker-controlled wallets to redirect funds.

- **Published:** 2026-06-17T00:00:00Z
- **Last reviewed:** 2026-06-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0840
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-josecmanxd-silke-clipper-tl-2026-0840.webp?v=f70edd6e (Threadlinqs threat intel: JoseCmanXD Silke Clipper via Fake Stars: Detection & IOCs (TL-2026-0840) — High severity, 41 IOCs, 9 detection rules.)
- **ID:** TL-2026-0840
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** JoseCmanXD
- **Detections:** 9 (1 shown free below) · **IOCs:** 41 (3 shown free below)

## Description

Check Point Research disclosed (June 17, 2026) an active, financially-motivated campaign operated by an actor using the Telegram/WordPress handle @JoseCmanXD that distributes a cross-platform Rust-based clipboard hijacker (a 'clipper'). The malware is delivered under the guise of cryptocurrency trading tools and gambling 'predictor' applications — Solana/Pump.fun sniper bots, Aviator Predictor, crash-game predictors and DEX trading automation — targeting users seeking shortcuts and quick crypto profits.

On Windows, a simple .NET loader executes an embedded Rust binary located at src/config/silkebin.exe. The Rust clipper copies itself to %APPDATA%\silke\silke.exe and establishes persistence via a Startup-folder shortcut. It registers a clipboard listener (AddClipboardFormatListener) and continuously inspects clipboard contents with embedded regular expressions for more than a dozen cryptocurrency address formats — Bitcoin (Bech32, legacy P2PKH, P2SH), Ethereum/EVM, Litecoin, TRON, XRP, Cardano, Monero, Dogecoin, Bitcoin Cash, Bitcoin Gold, Stellar and Zcash. When a wallet address is detected it is replaced (via OpenClipboard/EmptyClipboard/SetClipboardData) with an attacker-controlled address. The Windows variant ships a large embedded wallet database of roughly 15,000+ attacker Bitcoin addresses (~5,000 each of Bech32, legacy and P2SH) plus ~500 Ethereum addresses and entries for 15+ additional currencies, chosen to closely resemble the victim's intended recipient.

On macOS, a loader runs unlocker.command which bypasses Gatekeeper by stripping the quarantine attribute with 'xattr -cr' before launching the lure application. The macOS Rust executable monitors the pasteboard for wallet-like strings and persists by writing a shell script to ~/launch.sh and installing a LaunchAgent property list at ~/Library/LaunchAgents/com.example..plist, causing launchd to silently re-execute the binary on every login. A 30-second watchdog loop continuously re-writes both files and re-clones the binary to survive removal. The macOS variant uses a single attacker wallet per currency rather than a large database.

The campaign's defining characteristic is large-scale reputation manipulation. A WordPress phishing site acts as the central hub linking to all tools. The actor operates at least six GitHub accounts (Decryptor-j, crash-predictor1, roblox-script1, hack-scripts, stake-mines and others) whose repositories carry inflated stars (e.g. 146 stars, 62 forks) and have accrued ~5,000+ downloads (1,250+ for the macOS Aviator Predictor). Multiple SourceForge projects show 44,485 downloads, of which ~37,460 originate from suspicious Android devices concentrated in Pakistan and India, indicating download-farm inflation. The YouTube channel uses AI-generated narration and shows view spikes and positive engagement driven by Ghost Accounts. On VirusTotal, sock-puppet accounts post benign community comments and cast 'harmless' votes to disguise clearly malicious samples. Coordinated 'news' advertisements promoting the tools were published simultaneously across multiple outlets on April 27, 2026.

The actor has been active on hacking forums since 2019 and in 2022 advertised a tool titled 'BLACKHAT | Bitcoin Stealer | Advanced Builder | Tutorial | Clipper [Address Changer] + Re-Fud method', with early Russian-language YouTube content later shifting to English for a global audience. Blockchain analysis shows the attacker wallets received multiple transactions yielding notable illicit gains, and wallets are rotated frequently — once a malicious transaction completes the used wallet is swapped for a fresh 'clean' one. The malware is updated every few weeks, indicating an ongoing, profitable operation. No CVE is involved; this is commodity malware leveraging social-engineering supply-chain abuse rather than a software vulnerability.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1583.006 Web Services
- T1585.001 Social Media Accounts
- T1587.001 Malware
- T1608.001 Upload Malware
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1204.001 Malicious Link
- T1059.004 Unix Shell
- T1547.001 Registry Run Keys / Startup Folder
- T1543.001 Launch Agent
- T1553.001 Gatekeeper Bypass
- T1036.005 Match Legitimate Resource Name or Location
- T1036.008 Masquerade File Type
- T1070.009 Clear Persistence
- T1115 Clipboard Data
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**silke Clipper — .NET Loader Executes Unsigned Binary from %APPDATA%\silke (Exploitation)** (`TL-2026-0840-SPL-001`)

Detects the initial-execution footprint of the JoseCmanXD 'silke' Rust clipper on Windows: a .NET loader (lure trading-bot/predictor app) spawning or dropping the embedded Rust clipper (silkebin.exe) and the self-copy to %APPDATA%\silke\silke.exe. An unsigned PE written to and executed from a user-writable Roaming path under the 'silke' folder is the earliest reliable host signal of infection (masquerading as a legitimate app). Fires on Sysmon Process Create (EventCode=1) where the image path resolves into the silke working directory, or where a known-loader parent launches a child from AppData\Roaming.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1036.005
- **Data sources:** sysmon, windows_security, edr_process_telemetry
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval img=lower(Image), parent=lower(ParentImage), cmd=lower(CommandLine)
| where like(img,"%\\appdata\\roaming\\silke\\%") OR like(img,"%\\silkebin.exe") OR (like(parent,"%\\appdata\\local\\temp\\%") AND like(img,"%\\appdata\\roaming\\%\\silke%.exe")) OR like(cmd,"%src\\config\\silkebin.exe%")
| eval unsigned=if(Signed="false" OR isnull(Signed),1,0)
| stats count min(_time) as firstSeen max(_time) as lastSeen values(Image) as images values(ParentImage) as parents values(CommandLine) as cmdlines values(Hashes) as hashes by host, User
| convert ctime(firstSeen) ctime(lastSeen)
| where count > 0
```

### Microsoft KQL

```kql
// Sentinel — silke .NET loader executing unsigned clipper from %APPDATA%\silke
DeviceProcessEvents
| where Timestamp > ago(24h)
| extend FolderPathLower = tolower(FolderPath), InitFolderLower = tolower(InitiatingProcessFolderPath)
| where FolderPathLower has "\\appdata\\roaming\\silke\\" or FileName =~ "silkebin.exe" or (InitFolderLower has "\\appdata\\local\\temp\\" and FolderPathLower has "\\appdata\\roaming\\" and FileName endswith ".exe")
| where isempty(ProcessVersionInfoCompanyName) or ProcessVersionInfoOriginalFileName == ""
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: silke Clipper Unsigned Binary Execution from APPDATA\silke
id: 0a4e1c2e-1b9a-4d77-9a51-1c0840a00001
status: experimental
description: Detects execution of the silke Rust clipper (silkebin.exe / silke.exe) from the user-writable %APPDATA%\silke directory, typically launched by a .NET lure loader.
references:
    - https://research.checkpoint.com/2026/from-stars-to-upvotes-fake-reputation-fueling-a-crypto-clipboard-hijacker/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/17
tags:
    - attack.execution
    - attack.t1204.002
    - attack.defense_evasion
    - attack.t1036.005
logsource:
    product: windows
    category: process_creation
detection:
    selection_path:
        Image|contains: '\AppData\Roaming\silke\'
        Image|endswith: '.exe'
    selection_name:
        Image|endswith: '\silkebin.exe'
    condition: selection_path or selection_name
falsepositives:
    - Unlikely; no known legitimate software installs to %APPDATA%\silke. Investigate any hit.
level: high
```

**Known false positives:**

- No known legitimate software installs to %APPDATA%\silke; treat any match as suspicious.
- Security tooling or analysts intentionally detonating the sample in a sandbox.

**Tuning notes:** Tighten by correlating with the known clipper SHA-256 IOCs (e.g. 5518942d9d21794aaeff41a01b88606a96659fc329b481a2f0946d8163ab4d61). If Sysmon does not populate the Signed field reliably, drop the unsigned filter and rely on the path/name selector. Add an allowlist for approved AppData-resident apps if your environment legitimately runs any.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- silke Clipper — macOS Gatekeeper Bypass via xattr Quarantine Strip (Exploitation) (locked: unlock with TL Creds)
- silke Clipper — macOS LaunchAgent + [indicator] Watchdog Persistence (Post-Exploitation) (locked: unlock with TL Creds)
- silke Clipper — macOS Pasteboard Monitor + Cloned-Binary Self-Heal (C2/Impact) (locked: unlock with TL Creds)
- silke Clipper — Unsigned Self-Copy Written to %APPDATA%\silke (Exploitation) (locked: unlock with TL Creds)
- silke Clipper — macOS LaunchAgent Persistence Plist Drop (Post-Exploitation) (locked: unlock with TL Creds)
- silke Clipper — Outbound Crypto Transaction to Known Attacker Wallet (C2/Impact) (locked: unlock with TL Creds)
- silke Clipper — Startup-Folder Shortcut Persistence to %APPDATA% Binary (Post-Exploitation) (locked: unlock with TL Creds)
- silke Clipper — Clipboard-Listener Registration + Rapid Wallet Rewrites (C2/Impact) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 41)

Defanged, TLP:CLEAR.

- File hash: `5518942d9d21794aaeff41a01b88606a96659fc329b481a2f0946d8163ab4d61`
- File hash: `33c86ecfc324de3af97150bd009aba7925a6ba7a0842e127e94cf351013c0fe6`
- File hash: `7a7ad4ae347a3f99f3773a113d9f70ecfa967100c96e8275bd1df833caee68d1`

Full set of 41 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker](https://research.checkpoint.com/2026/from-stars-to-upvotes-fake-reputation-fueling-a-crypto-clipboard-hijacker/)
- [MITRE ATT&CK T1115 — Clipboard Data](https://attack.mitre.org/techniques/T1115/)
- [MITRE ATT&CK T1547.001 — Registry Run Keys / Startup Folder](https://attack.mitre.org/techniques/T1547/001/)
- [MITRE ATT&CK T1543.001 — Create or Modify System Process: Launch Agent](https://attack.mitre.org/techniques/T1543/001/)
- [MITRE ATT&CK T1553.001 — Subvert Trust Controls: Gatekeeper Bypass](https://attack.mitre.org/techniques/T1553/001/)
- [Cryptocurrency Miner and Clipper Malware Spread via SourceForge Cracked Software Listings](https://thehackernews.com/2025/04/cryptocurrency-miner-and-clipper.html)
- [New clipboard hijacker replaces crypto wallet addresses with lookalikes](https://www.bleepingcomputer.com/news/security/new-clipboard-hijacker-replaces-crypto-wallet-addresses-with-lookalikes/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0840