Skip to navigation

Threat reportMalwareTL-2026-4766

Clipbanker malware AnimateClipper (ZigClipper) and Efimer redirect crypto payments by swapping clipboard wallet addresses

highACTIVE

ReversingLabs describes clipbanker malware families AnimateClipper (ZigClipper) and Efimer that replace copied cryptocurrency wallet addresses with attacker-controlled ones. Efimer matches the first or last 1-3 digits of the victim address to make swaps harder to notice; delivery is via fake software installers, ClickFix, phishing emails and fake torrent sites.

Key facts for AnimateClipper and Efimer clippers

IdentifiersTL-2026-4766
Also known asZigClipper, AnimateClipper
SeverityHIGH
Exploitation statusExploited in the wild
Affected productsMicrosoft Windows (end-user systems running cryptocurrency wallets or exchanges)
MalwareACR Stealer, AnimateClipper, ClearFake, ClipBanker, Clipper, CryptoBandit, Efimer
MITRE ATT&CK techniquesT1027 Obfuscated Files or Information, T1036 Masquerading, T1053.005 Scheduled Task, T1059.007 JavaScript, T1071.001 Web Protocols, T1090.003 Multi-hop Proxy, T1113 Screen Capture, T1140 Deobfuscate/Decode Files or Information, T1204.002 Malicious File, T1204.004 Malicious Copy and Paste, T1566.001 Spearphishing Attachment, T1657 Financial Theft
MotivationFINANCIAL
Target sectorsfinance, cryptocurrency, individual users
Target regionsGlobal
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage for AnimateClipper and Efimer clippers

As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4766 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: AnimateClipper/Efimer Clipbanker Payload Launch or ClickFix PowerShell Cradle — Exploitation Phase

Behaviour-first detection of the execution stage of the AnimateClipper (ZigClipper) and Efimer clipbanker campaigns: known payload filenames (Taskforce.exe, quis.exe, nvd_driver_dll.exe, clean_driver_dll.exe, visioncraft_ai.exe), short-named payloads (SW.exe, 3.exe, 1.exe, 666.exe) in user-writable folders, and ClickFix PowerShell download cradles spawned from explorer.exe after a fake identity-verification prompt. Maps to T1204.002, T1204.004, T1036, T1105.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1204.002, T1204.004, T1036, T1105
  • Data sources: sysmon, windows_process_creation
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| eval img=lower(Image), cmd=lower(CommandLine), parent=lower(ParentImage)
| eval named_payload=if(match(img,"\\\\(taskforce|quis|nvd_driver_dll|clean_driver_dll|visioncraft_ai)\.exe$"),1,0)
| eval short_payload=if(match(img,"\\\\(appdata|downloads|temp|desktop|public)\\\\([^\\\\]+\\\\)*(sw|3|1|666)\.exe$"),1,0)
| eval clickfix=if(match(parent,"\\\\explorer\.exe$") AND match(img,"\\\\(powershell|pwsh)\.exe$") AND match(cmd,"(iex|invoke-expression|invoke-webrequest|iwr|downloadstring|frombase64string)") AND match(cmd,"(-w(indowstyle)?\s+hidden|-nop|-ep\s+bypass|-enc)"),1,0)
| where named_payload=1 OR short_payload=1 OR clickfix=1
| eval detection_reason=case(named_payload=1,"known_clipper_payload_filename",short_payload=1,"short_name_payload_in_user_path",clickfix=1,"clickfix_powershell_download_cradle")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines by host User Image ParentImage detection_reason
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let lookback = 24h;
let payload_names = dynamic(["taskforce.exe", "quis.exe", "nvd_driver_dll.exe", "clean_driver_dll.exe", "visioncraft_ai.exe"]);
DeviceProcessEvents
| where Timestamp > ago(lookback)
| extend Cmd = tolower(ProcessCommandLine)
| extend NamedPayload = FileName in~ (payload_names)
| extend ShortPayload = FolderPath matches regex @"(?i)\\(AppData|Downloads|Temp|Desktop|Public)\\([^\\]+\\)*(sw|3|1|666)\.exe$"
| extend ClickFix = tolower(InitiatingProcessFileName) == "explorer.exe" and FileName in~ ("powershell.exe", "pwsh.exe") and Cmd matches regex @"(iex|invoke-expression|invoke-webrequest|iwr|downloadstring|frombase64string)" and Cmd matches regex @"(-w(indowstyle)?\s+hidden|-nop|-ep\s+bypass|-enc)"
| where NamedPayload or ShortPayload or ClickFix
| extend DetectionReason = case(NamedPayload, "known_clipper_payload_filename", ShortPayload, "short_name_payload_in_user_path", "clickfix_powershell_download_cradle")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionReason

Sigma

title: Clipbanker ClickFix PowerShell Cradle or AnimateClipper/Efimer Payload Launch
id: 7c1e9a52-3f4b-4d86-9a1e-5b2d8c6f4a01
status: experimental
description: Detects execution of known AnimateClipper/ZigClipper and Efimer payload filenames, short-named payloads (SW.exe, 3.exe, 1.exe, 666.exe) run from user-writable folders, and ClickFix-style PowerShell download cradles spawned from explorer.exe (Run dialog).
references:
    - https://www.reversinglabs.com/blog/threat-researchers-notebook-how-attackers-redirect-crypto-payments
    - https://securelist.com/efimer-trojan/117148/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-29
tags:
    - attack.execution
    - attack.t1204.002
    - attack.t1204.004
    - attack.defense-evasion
    - attack.t1036
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_name:
        Image|endswith:
            - '\taskforce.exe'
            - '\quis.exe'
            - '\nvd_driver_dll.exe'
            - '\clean_driver_dll.exe'
            - '\visioncraft_ai.exe'
    selection_short:
        Image|re: '(?i)\\(appdata|downloads|temp|desktop|public)\\([^\\]+\\)*(sw|3|1|666)\.exe$'
    selection_clickfix_parent:
        ParentImage|endswith: '\explorer.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'iex'
            - 'invoke-expression'
            - 'invoke-webrequest'
            - 'iwr'
            - 'downloadstring'
            - 'frombase64string'
    selection_clickfix_flags:
        CommandLine|contains:
            - '-w hidden'
            - '-windowstyle hidden'
            - '-nop'
            - '-ep bypass'
            - '-enc'
    condition: selection_name or selection_short or (selection_clickfix_parent and selection_clickfix_flags)
falsepositives:
    - Admin scripts launched interactively from the Run dialog with download cradles
    - Legitimate software that ships a file named 1.exe or 3.exe in a user profile folder
level: high

Known false positives:

  • Administrators who paste PowerShell download cradles into the Run dialog for legitimate deployment
  • Third-party software that legitimately ships 1.exe, 3.exe or SW.exe inside a user profile folder

Tuning notes: Short names (sw/3/1/666) are matched only under Downloads/AppData/Temp/Desktop/Public; exclude your software-deployment tooling by Image path or ParentImage. Tighten the ClickFix leg by requiring an external URL in CommandLine. Sysmon EventCode=1 must be collected into index=sysmon; adjust index/sourcetype to local naming.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Efimer WSF/JS Installer via Script Host and Clipbanker IOC Hash Match — Exploitation Phase · unlock with TL Creds
  • Efimer Pyarmor Runtime Load from PyInstaller/User-Writable Path — Post-Exploitation · unlock with TL Creds
  • Clipbanker Payload Staging Download from Known Infrastructure — C2 Phase · unlock with TL Creds
  • AnimateClipper/Efimer Payload File Creation — Exploitation Phase · unlock with TL Creds
  • Scheduled Task Persistence for User-Path Payload or Script Host (Efimer) — Post-Exploitation · unlock with TL Creds
  • DNS Resolution of Clipbanker C2 Domains and Tor Onion Names — C2 Phase · unlock with TL Creds
  • Clipbanker Clipboard Rewrite by Process in User-Writable Path — Post-Exploitation · unlock with TL Creds
  • Clipbanker C2 / Staging IP and Local Tor Proxy Connections — C2 Phase · unlock with TL Creds

Indicators of compromise for AnimateClipper and Efimer clippers

As of 2026-10-29, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-4766.

Sample indicators (3 of 30)

  • IP address: 167.233.30[.]202
  • Domain: gfoqsewps57xcyxoedle2gd53o6jne6y5nq5eh25muksqwzutzq7b3ad[.]onion
  • File hash: e46f514e456c5e27f60854e4156234e6ae8c4dd5892ddb4d2d557de02fc2cd15

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

30 indicators of compromise · unlock with TL Creds. Compare plans

Community OSINT corroboration for AnimateClipper and Efimer clippers

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How AnimateClipper and Efimer clippers works

ReversingLabs' Threat Researcher's Notebook documents two Windows clipbanker (clipper) families monitored through 12 October 2026. Clipbankers watch the clipboard for strings matching cryptocurrency wallet address formats and silently substitute an attacker-controlled address so that a victim's paste sends funds to the attacker.

AnimateClipper (also tracked as ZigClipper) is a relatively new family first detected in January 2026, with widespread activity in July 2026. Its droppers and payloads are built with the Zig compiler. It recognizes multiple wallet address patterns and swaps in an attacker wallet from the same cryptocurrency ecosystem. It is frequently distributed alongside infostealers; public sample-sharing tags associate it with ClearFake and ACRStealer. ReversingLabs published five AnimateClipper C2 hostnames, eleven distribution URLs and 25 SHA256 hashes collected in September 2026. Payload filenames include Taskforce.exe, quis.exe, 666.exe, nvd_driver_dll.exe, clean_driver_dll.exe, SW.exe, 3.exe and 1.exe.

Efimer is an older family (first reported by Kaspersky in October 2024) notable for digit-matching address replacement: depending on the cryptocurrency, the replacement address is chosen so that the first or last 1-3 characters match the address the victim copied, which makes the swap harder to spot. It recognizes Ethereum (0x prefix), Bitcoin and Monero addresses (Kaspersky additionally reports Tron and Solana and theft of seed phrases). It also exfiltrates clipboard data and screenshots, communicates with C2 over Tor .onion services at scheduled intervals, accepts remote commands, and uses Pyarmor protection, XOR-encrypted payloads, obfuscated JavaScript and scheduled tasks. ReversingLabs observed a 24-hour sample set in August 2026 (builds generated roughly hourly, 24 samples per day) consisting of PyInstaller executables, Pyarmor DLLs, a scheduled-task XML and JavaScript payloads, with an Efimer surge between 17 and 21 August 2026. The report notes CryptoBandit (emerged 2026) as a possible Efimer evolution with similar digit-matching behavior.

Delivery vectors named in the report are fake software installations (imitating IIPaint Software, VisionCraft Labs and the Composer dependency manager for PHP), ClickFix prompts (including fake PowerShell identity verification requests), phishing emails and fake torrent sites. Detection activity peaked in July 2026 and decreased in August; the report states both families became inactive after the research period. No CVE, CVSS score or actor attribution is stated in the source; severity is analyst-assigned.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information

Persistence

T1053.005 Scheduled Task

Execution

T1059.007 JavaScript; T1204.002 Malicious File; T1204.004 Malicious Copy and Paste

Command and Control

T1071.001 Web Protocols; T1090.003 Multi-hop Proxy

Collection

T1113 Screen Capture

Initial Access

T1566.001 Spearphishing Attachment

Impact

T1657 Financial Theft

Remediation for AnimateClipper and Efimer clippers

Immediate actions

  • Block the published C2 hostnames, payload-hosting domains and IPs at DNS, proxy and firewall layers
  • Block or alert on Tor (.onion) traffic and the local Tor proxy on workstations that have no business need for it
  • Hunt endpoints for the published SHA256 hashes and for the filenames visioncraft_ai.exe, nvd_driver_dll.exe, clean_driver_dll.exe, quis.exe and Taskforce.exe
  • Review scheduled tasks and Run keys created by user-writable-path executables on endpoints with suspected infection

Workarounds

  • Compare the pasted wallet address with the intended address character by character before sending funds
  • Decline any PowerShell or Run-dialog identity verification request; legitimate services do not require it

Longer-term hardening

  • Deploy behavior-based detection focused on clipboard access and replacement by untrusted processes
  • Train users to re-verify the full wallet address before confirming any cryptocurrency transaction and to never paste commands from web prompts into PowerShell or Run dialogs (ClickFix)
  • Restrict software installation to approved sources and block downloads from untrusted torrent and file-sharing sites

Affected and fixed versions

  • Microsoft — Windows (end-user systems running cryptocurrency wallets or exchanges)
    Vulnerable versions: Not version-specific

Timeline of AnimateClipper and Efimer clippers

  • locked-ioc-30 first appears around October 2024, initially spread via compromised WordPress sites (Kaspersky/Securelist)
  • locked-ioc-30 operators expand distribution to mass phishing emails with password-protected archives containing a WSF installer (Kaspersky/Securelist)
  • Kaspersky publicly details the locked-ioc-30 trojan, reporting 5,015 affected users between October 2024 and July 2025
  • locked-ioc-26 (ZigClipper) first detected in January 2026 (ReversingLabs; exact day not stated)
  • Peak detection period for both locked-ioc-26 and locked-ioc-30 in July 2026 (exact day not stated)
  • locked-ioc-30 surge observed 17-21 August 2026; a 24-hour sample set shows builds generated roughly hourly
  • locked-ioc-26 IOCs and 25 SHA256 hashes collected during September 2026 (exact day not stated)
  • ReversingLabs monitoring period ends; both families reported inactive after research completion
  • ReversingLabs publishes 'Threat Researcher's Notebook: How Attackers Redirect Crypto Payments' with C2 and hash IOCs

Sources cited for AnimateClipper and Efimer clippers

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats