Crypto malware—clippers, infostealers, and poisoned npm packages—steals wallet keys and swaps addresses. Learn how clipboard hijacking, Lazarus job scams, and supply-chain attacks work, plus defenses.
+5 sources across the wider coverage universe
MetaMask flags rise of AI-driven crypto attacks, from fake Google security pages to malware hitting 850+ extensions, exposing growing risks in automated fraud2026-04
Security analyst reveals how Lazarus Group uses a macOS malware kit “Mach-O Man,” luring victims via fake Zoom and Google Meet links to execute malicious commands and gain full system access2026-04
Bybit uncovers macOS malware campaign targeting Claude Code searches, using SEO poisoning to steal crypto wallet credentials and enable remote access2026-04
Hackers hide malware in GitHub, npm, and VS Code packages using invisible Unicode so supply‑chain attacks bypass human review and common defenses.2026-03
DPRK-linked Contagious Interview campaign turns Web3 job tests into wallet-stealing malware2026-05
Humanity Protocol's 447M H token attack wasn't a hack—it was operational security FAIL: malware on a dev machine gave attackers full root access to 7 private keys, draining $31M+ because devs backed up keys to the wrong device during mainnet launch2026-06
Malicious software that quietly compromises a device to steal cryptocurrency — by harvesting wallet keys, swapping payment addresses, or hijacking developer tools — is one of the most persistent threats in the digital-asset economy. Unlike protocol exploits that target smart contracts, this class of attack targets the human and the endpoint, where private keys and clipboards live.
Because blockchain transactions are irreversible and pseudonymous, a single infected machine can mean permanent, unrecoverable loss. Understanding how these tools work, who deploys them, and how the threat is shifting is now a baseline part of operating safely in crypto.
What Malware Means in a Crypto Context
Malware ("malicious software") is any program designed to run on a device against the owner's interest. In crypto, the goal is almost always financial: obtain the secrets that authorize spending. Those secrets are private keys and seed phrases (the human-readable backup of a key), and the files or browser data tied to a wallet.
The most common crypto-targeting categories are:
- Infostealers — broad-spectrum credential thieves that scrape browser-stored passwords, session cookies, wallet files, and seed phrases from disk, then exfiltrate them to an attacker's server.
- Clippers (clipboard hijackers) — narrow tools that watch the clipboard and silently substitute a copied wallet address with the attacker's.
- Remote access tools (RATs) and backdoors — give an operator interactive control of the machine, often used against developers to reach key material and infrastructure.
- Supply-chain payloads — malicious code injected into otherwise legitimate software packages so that the victim installs it themselves.
What unites them is that they exploit the gap between signing a transaction and understanding it. The blockchain faithfully executes whatever the compromised device authorizes.
MetaMask flags rise of AI-driven crypto attacks, from fake Google security pages to malware hitting 850+ extensions, exposing growing risks in automated fraud
Torg Grabber compiled 334 unique samples in three months while scanning 850 extensions across 33 browser variants — that's a faster iteration cycle than most DeFi protocols ship features. Browser extensions bled $713M in 2025 alone, and now the attack surface is expanding in both directions: AI agents like OpenClaw are getting delegated wallet permissions for autonomous transactions while simultaneously being weaponized for autonomous exploitation (MetaMask's own December report showed AI agents draining $4.6M from test contracts and finding two novel zero-days). The irony of MetaMask partnering with CoinFello on hardware-isolated keys for AI agents in the same report where they document AI agents as the threat vector tells you exactly where this arms race is headed — wallet infra is being rebuilt around the assumption that the thing signing your transactions might also be the thing attacking them.
Readers click malware stories not for technical forensics but for personal exposure — the pattern skews heavily toward 'could this hit me right now': Mac users, specific named wallets, supply-chain packages they might have installed, and USB sticks that could arrive in the mail.
How Clipper Malware Works
Clippers are a clear illustration of why crypto is uniquely exposed. Once resident, the malware polls the clipboard — roughly every 500 milliseconds in observed samples — for strings matching wallet-address patterns: a Bitcoin address of 26–35 characters, or an Ethereum address beginning with 0x followed by 40 hex characters. When it sees one, it replaces the copied value with an attacker-controlled address in real time, so the victim pastes the wrong destination and confirms a payment to a stranger (Halborn).
The technique is effective precisely because addresses are long, random-looking strings that users rarely read in full. Advanced variants generate substitute addresses whose first and last characters match the original, defeating the common habit of glancing only at the ends (Coin98). Clipper malware has circulated since 2017, and single campaigns have netted six-figure sums (Halborn).
In early 2026, Microsoft Threat Intelligence documented a Windows "Crypto Clipper" that spreads through USB drives and malicious .lnk shortcut files and routes its traffic over the Tor network to mask its infrastructure. It has been active since February 2026 and demonstrates that even low-tech delivery — a borrowed thumb drive — remains viable. The defensive guidance is mundane but effective: disable AutoRun for removable media, restrict .lnk execution, and always re-verify a destination address after pasting and before signing.
- 01Named wallet extension targeting
Headlines naming MetaMask, Phantom, Coinbase Wallet, and OKX by name drove outsized clicks because readers self-identify as holders of those exact tools.
- 02North Korea / Lazarus attribution
State-sponsored attribution to Lazarus and DPRK hackers signals scale and sophistication that elevates the story beyond ordinary cybercrime.
- 03Developer supply-chain poisoning
npm packages, GitHub repos, and VS Code extensions with billions of weekly downloads represent invisible attack surface for technical readers who use these tools daily.
- 04Social engineering via fake jobs and calls
Fake job interviews, Zoom links, and GitHub trading bot repos exploiting developer trust were a recurring and clicked angle, reflecting anxiety about targeted deception.
- 05Clipboard hijacking and address replacement
Clipper malware silently swapping wallet addresses during transactions is a concrete, catastrophic loss scenario that resonates with anyone who has ever copy-pasted a crypto address.
- 06macOS as a malware target
Multiple high-click stories broke the assumption that macOS is safe, directly challenging the perceived security posture of the crypto developer demographic.
Common Infection Routes
Crypto malware reaches victims through a handful of recurring channels:
Trojanized downloads and disguised content. Attackers wrap stealers inside things people want. A recent campaign abused Steam's Workshop and the popular Wallpaper Engine app to distribute crypto-stealing payloads dressed up as animated, often anime-styled wallpapers — turning a gaming storefront into a delivery channel. The same pattern appears with cracked software, fake app updates, and tampered installers; attackers have inserted malware into the download for Mistral AI's software, among others.
Social engineering and fake meetings. "ClickFix" style attacks present a fake error or "outdated version" popup — frequently impersonating a Google Meet or Zoom call — and instruct the victim to paste a command into their terminal, executing the malware themselves. Infiniti Stealer has used this approach to drain macOS wallets. Search-engine "SEO poisoning" complements it: Bybit documented a campaign that planted malicious results for macOS users searching for developer tools like Claude Code, steering them to wallet-stealing downloads with remote-access capability.
Removable media. As the Crypto Clipper shows, USB propagation persists, particularly in environments where machines are shared or air-gapped from normal patching.
Security analyst reveals how Lazarus Group uses a macOS malware kit “Mach-O Man,” luring victims via fake Zoom and Google Meet links to execute malicious commands and gain full system access
Radiant Capital lost $50M to this exact chain in October '24 — Lazarus DM'd a dev posing as a former contractor, ran a fake Zoom that dropped the payload, compromised enough multisig signers to forge the transfer call. Every macOS-using signer on every protocol is the target profile, and a Ledger on the desk doesn't save you when the machine approving the tx is owned. Recruiter DM → "quick call" is the attack surface now, not the solidity code.
- 2024-08milestone
Cthulhu macOS malware targeting MetaMask, Coinbase, Binance wallets publicly warned
- 2024-09milestone
Binance blacklists Clipper malware addresses, issues user safety alerts
- 2025-02exploit
Bybit suffers $1.4B hack linked to Lazarus Group
- 2025-03milestone
Microsoft discloses StilachiRAT targeting seven major crypto wallet browser extensions
- 2025-03exploit
Lazarus Group deposits 400 ETH from Bybit hack into Tornado Cash, deploys BeaverTail malware
- 2025-04milestone
Crocodilus Android malware emerges targeting crypto users in Asia and Europe
- 2025-05milestone
Microsoft reports 394,000 Windows machines infected by Lumma stealer globally
- 2025-06exploit
Bybit identifies macOS malware campaign using SEO poisoning of Claude Code searches to steal wallet credentials
The Developer Supply Chain Threat
The most consequential shift is the targeting of the people who build crypto, not just those who hold it. Compromising one developer can yield production keys, signing infrastructure, and access to thousands of downstream users.
Poisoned packages. The npm registry has become a primary battleground. The self-replicating "Shai-Hulud" worm automated the compromise and republication of packages; a 2026 wave hit the TanStack and AntV ecosystems, and the broader campaign exposed tens of thousands of secrets across more than 20,000 repositories (Microsoft Security). Payloads harvest credentials from over 130 file paths — including AWS, GCP, Kubernetes, and cryptocurrency wallets — and read CI/CD memory to extract secrets. A separate campaign dubbed "TrapDoor" used 34+ malicious packages to target Aptos, Sui, and Solana developer environments, stealing SSH keys and wallet files; reporting notes it even attempted to hijack AI coding assistants so future sessions would run attacker-controlled "security scans."
Fake job interviews. The DPRK-linked "Contagious Interview" campaign, attributed to the Lazarus Group, poses recruiters from crypto and AI firms who ask candidates to clone and run a coding "assignment." Opening the project in an editor like VS Code triggers a task configuration that fetches a backdoor (variants include BeaverTail and OtterCookie). On macOS, Lazarus's "Mach-O Man" toolkit reaches Keychain data and credentials via fake video-conferencing links (CertiK via CoinDesk). Lazarus alone is estimated to have stolen over $6 billion in crypto since 2017.
The Humanity Protocol incident in June 2026 shows the stakes: an investigation concluded that malware on a single developer machine gave an attacker root access and seven private keys, draining over $31 million — a failure of operational security, not a smart-contract bug.
- Smart-contractLow
Malware in this topic cluster targets wallets and credentials on the client side, not on-chain contract logic — the smart contract layer itself is not the attack surface.
- Supply-chainHigh
Compromised npm packages with billions of weekly downloads and poisoned GitHub repos show the software dependency chain is a primary and scalable attack vector against crypto users.
- Social engineeringHigh
Fake job tests, Zoom calls, AI tool installers, and Claude Code search poisoning demonstrate that human trust is being systematically exploited to bypass technical defenses.
- Platform / OSMedium
Both Windows (Lumma, StilachiRAT, LeakyStealer) and macOS (Cthulhu, Mach-O Man, Amatera) are actively targeted, eroding the safe-platform assumption for any operating system.
- RegulatoryLow
Malware attacks are criminal law matters; no significant regulatory framework shift has been triggered by these incidents in the covered period.
- Market / LiquidityMedium
Large-scale theft events such as the $1.4B Bybit hack and subsequent Tornado Cash deposits by Lazarus Group create measurable sell pressure and market instability.
Who Is Behind These Campaigns
Crypto malware spans the spectrum from opportunists to nation-states. At one end, commodity infostealers are sold as off-the-shelf kits, run by financially motivated hackers for broad, indiscriminate theft. At the other, state-sponsored groups — Lazarus being the most prominent — run patient, targeted operations against employees of specific exchanges and protocols, laundering proceeds through mixers and bridges.
Increasingly, the two converge on developers and on AI tooling. MetaMask has flagged a rise in AI-driven attacks, from convincing fake Google security pages to malware affecting hundreds of browser extensions. AI lowers the cost of producing believable lures and obfuscated code, while AI coding assistants and their search traffic have themselves become targets and delivery vectors.
Bybit uncovers macOS malware campaign targeting Claude Code searches, using SEO poisoning to steal crypto wallet credentials and enable remote access
Mac devs searching Google for Claude Code are the richest target set in crypto malware right now — ssh keys, prod AWS tokens, and hot wallet seeds all colocated in a keychain on boxes that rarely run EDR. Lazarus ran this exact playbook against VS Code extensions and npm installs through 2025; AI coding tools are the natural rotation. Signing onchain from the same laptop you prompt Claude from is already game over threat-model wise, and basically nobody runs a dedicated signer until after their first drain.
Defenses That Actually Help
No single control is sufficient, but layered habits sharply reduce exposure:
- Use a hardware wallet for meaningful balances. Keys never leave the device, so an infected computer cannot extract them; you still must verify the destination address on the hardware screen, which defeats clippers.
- Verify addresses end to end. Re-check the full address on the signing device after pasting — not just the first and last characters.
- Treat unsolicited "assignments," meeting popups, and updates as hostile. Never paste terminal commands you don't understand, and never run an interview "test project" on a machine that holds keys.
- Isolate development from custody. Keep signing keys off developer laptops; back them up to hardware or offline media, never to a working machine. Pin dependencies, audit new packages, and scope CI/CD secrets tightly.
- Harden the endpoint. Keep Microsoft Defender or equivalent enabled, disable USB AutoRun, restrict
.lnkexecution, and patch promptly. - Compartmentalize. A dedicated, clean device for high-value transactions limits the blast radius of any single infection.
Outlook
Crypto malware is trending toward the supply chain and the developer, where leverage is highest, and toward AI-assisted social engineering that makes lures harder to spot. Expect more self-propagating package worms, more impersonation of legitimate tools and meetings, and continued nation-state interest in protocol teams. The countermeasures, however, are stable and within reach: hardware-based key isolation, disciplined verification of every transaction, and a default skepticism toward anything that asks you to download, paste, or run. In an ecosystem where transactions cannot be reversed, prevention at the endpoint is the only reliable form of recovery.
Latest malware news
MetaMask flags rise of AI-driven crypto attacks, from fake Google security pages to malware hitting 850+ extensions, exposing growing risks in automated fraudSecurity analyst reveals how Lazarus Group uses a macOS malware kit “Mach-O Man,” luring victims via fake Zoom and Google Meet links to execute malicious commands and gain full system accessBybit uncovers macOS malware campaign targeting Claude Code searches, using SEO poisoning to steal crypto wallet credentials and enable remote accessHackers hide malware in GitHub, npm, and VS Code packages using invisible Unicode so supply‑chain attacks bypass human review and common defenses.DPRK-linked Contagious Interview campaign turns Web3 job tests into wallet-stealing malwareHumanity Protocol's 447M H token attack wasn't a hack—it was operational security FAIL: malware on a dev machine gave attackers full root access to 7 private keys, draining $31M+ because devs backed up keys to the wrong device during mainnet launchCommunity notes
Spot something off or out of date? Drop a note. Editors review topic notes daily and roll accepted fixes into the explainer — contributors are recognized in the monthly $SQUID drop.
Loading notes…