Beware of Clipboard Virus!

[yazher]

This was an old virus and the person behind it is a genius because they know that most people are not paying attention when it comes to sending their BTC and double check the addresses especially if the amount is just low but this could be very dangerous for some person who is sending a huge amount of BTC because he couldn't see where he went wrong until the transactions have been successful and he double check the address by that time and finally understand it all why he haven't received his BTC. That's why exchanges have some warning options to let you know that you should be double-checking the BTC address in order to prevent yourself from sending it to scammers such as this one.

[1714615699]

1714615699

[libert19]

Since I come to realize that there is thing called clipboard virus which can change the address halfway I have started checking address in middle as well.

My revolution:

copy-paste address blindly >> check first letters >> check first and last letters >> current stage: check first-middle-end letters

I hope it doesn't come to stage where you have check whole address letter by letter  

[Gladitorcomeback]

And this is the third time I have gotten infected with the clipboard virus. I don't know why I always end up with the particular virus. Though I don't know how to properly define this thing as a virus or malware. I don't use any third-party antivirus, but my Windows Defender is always on. So I have no idea how I got infected. Windows defender seems to not be working regarding this virus. I guess, other antivirus programs won't work either. There is no way to fix this. So unfortunately, I had to reinstall Windows twice the same day to fully get rid of this virus. Such a hassle. Lucky for me, I didn't send out any funds since I remembered my original address. The moment I saw a change of address, I knew something was wrong. Here is the phishing address. The total received amount is almost $28k I wonder how many innocent people fell a victim to it.

This why I always advice to use mobile for transaction and stay away from doing any single transaction in the PC where this scam attacks are in the high numbers. Actually I have so much experience in this matter because I lost more than 1k$. Unfortunately some of my old address become victim permanent which I used for farming airdrop.

The reason of this could be installing windows from Third party/Installation of free apps(crack).

You should have to install the new window/Linux as soon as you can because your phrase or any other information could be compromised. Never use free version software which often lead to keyboard hack. I will recommend Mobile for transaction purpose which is much safer than PC but if you like to do in PC then just follow above safety step

[DYING_S0UL]

Since I come to realize that there is thing called clipboard virus which can change the address halfway I have started checking address in middle as well.

My revolution:
copy-paste address blindly >> check first letters >> check first and last letters >> current stage: check first-middle-end letters
I hope it doesn't come to stage where you have check whole address letter by letter  

Good realization mate. BTW, I don't think this malware has come to that point to clone an entire/slightly different or half of an address. It hasn't become that capable yet. One thing I'm unsure of is what triggers this virus. Certainly copy pasting casual text won't make it active, while I was infected I only realized after copying a btc address. Another thing is this virus only targets specific address? This is my concern. If it only targeted BTC then other altcoin address won't active it. And sending altcoins to an bitcoin address doesn't make sense, it it? My guess it only targets the big ones such as bitcoin or etheream etc. So if a user is infected and only uses altcoins, there is a big chance he won't detect that he is infected.

Only solution is to always memorize your address (the last part).

Ilost more than 1k$. Unfortunately some of my old address become victim permanent which I used for farming airdrop.

Sorry for your loss. Isn't airdrop a thing of a past now? Currently most of them seemed fake to me.

The reason of this could be installing windows from Third party/Installation of free apps(crack).

Correct answer.

You should have to install the new window/Linux as soon as you can because your phrase or any other information could be compromised.

I did but later I reverted back to windows. I have been using windows my entire life. Felt uncomfortable, not user friendly. Anyway, what distro you use? Any suggestion?

[DubemIfedigbo001]

And this is the third time I have gotten infected with the clipboard virus. I don't know why I always end up with the particular virus. Though I don't know how to properly define this thing as a virus or malware. I don't use any third-party antivirus, but my Windows Defender is always on.

No bro, you should use one, window defender is good, but its virus definition sometimes is limited, its defending windows from crashing or being affected with virus and in my own experience, its protecting against boot sector virus only. Other types of virus might pass unnoticed by it as far as it doesn't affect the OS.
There are other types of virus, to mention but a few namely:

• web  scripting virus
• polymorphic virus
• Resident Virus
• multipartite virus

and a  host of others. As far as you're going online, you need antivirus to combat the viruses flying all over the net which might be more powerful than just your windows defender. There's such things as specialization, and in the area of protecting the computer properly against most virus, paid plan Antivirus is the best.

So I have no idea how I got infected. Windows defender seems to not be working regarding this virus. I guess, other antivirus programs won't work either. There is no way to fix this. So unfortunately, I had to reinstall Windows twice the same day to fully get rid of this virus.

Now I'll still ask you a question. Do you update your computer after formatting?, or do you just format and start using it without proper updates?. This has an important role to play in the overall security of your computer. There's a program called malicious files and virus removal tool in the windows OS. if you don't update your computer properly(not just using drivers pack), it will not be energized to help you defend the computer from certain viruses. Leaving your computer vulnerable and your windows defender powerless.

[LoyceV]

Only solution is to always memorize your address (the last part).

The only solution is the check the entire address. Address reuse is bad for privacy anyway, so memorizing the address doesn't make sense.

[Lucius]

Only solution is to always memorize your address (the last part).

The only solution is the check the entire address. Address reuse is bad for privacy anyway, so memorizing the address doesn't make sense.

Exactly, because some clipboard malwares have gone a little further than simple address replacement - they already try to replace the original address by searching in their database for the one that most closely resembles the owner's address. I know I once read about it here on the forum, and I think hackers will become even more inventive, especially now that they are using AI.

When it comes to checking addresses, those who know the risks leave nothing to chance, right?

Ledger omitting one character from a Doge address

[icalical]

This is not a new thing definitely, if you said that this is not your first time then maybe re-installing into a fresh operating system could prevent this from happened again, and also complete scan your whole disk with the latest update of anti-virus database. Now to prevent you from accidentally sending to a virus address, you could use app that has contact book feature so you don't need to copy and paste everytime you send your fund to your usual address.

[Pandu Geddon]

Now to prevent you from accidentally sending to a virus address, you could use app that has contact book feature so you don't need to copy and paste everytime you send your fund to your usual address.

yes, if it's a routine transaction like sending to our exchange address, it might be possible to do it. but if you have just made a transaction with someone else or have just had several transactions, we can copy and paste the address or scan the QR code.
Copy and paste activities are often done. and if it gets a virus, of course, it becomes a serious problem. Always double-check the destination address carefully before approving a transaction. Sometimes we are too hasty and too sure of what we usually do. and that is the loophole for scammers in this way.

[TravelMug]

This is not a new thing definitely, if you said that this is not your first time then maybe re-installing into a fresh operating system could prevent this from happened again, and also complete scan your whole disk with the latest update of anti-virus database. Now to prevent you from accidentally sending to a virus address, you could use app that has contact book feature so you don't need to copy and paste everytime you send your fund to your usual address.

Yes, this has been going for many years now, clipboard virus has evolved so much. And there are a lot of warnings from the community regarding this kind of attack. So I guess with the price going up again, there could be a lot of scammers and malwares and other ways to get infected by this kind of clipboard virus. And on our part, we should check everything before we send our bitcoin to someone. It might not be their addresses, and if we found out that way, then our machine are infected. So the best course of action is to reinstall everything from scratch and then install the latest AV and test if the virus is still in your computer.

[EL MOHA]

Good realization mate. BTW, I don't think this malware has come to that point to clone an entire/slightly different or half of an address. It hasn't become that capable yet. One thing I'm unsure of is what triggers this virus. Certainly copy pasting casual text won't make it active, while I was infected I only realized after copying a btc address. Another thing is this virus only targets specific address? This is my concern. If it only targeted BTC then other altcoin address won't active it. And sending altcoins to an bitcoin address doesn't make sense, it it? My guess it only targets the big ones such as bitcoin or etheream etc. So if a user is infected and only uses altcoins, there is a big chance he won't detect that he is infected.

Only solution is to always memorize your address (the last part).

They can actually clone almost a full address with just maybe a two or three characters missing from it. This is possible with vanity address generators. Since with this type of address you can choose your own few characters rather than all of them been randomly generated. That is why the attack is on specific address maybe those that look similar. The best thing is to use an offline wallet and if you get infected with this malware just reformat the HD

As for addresses memorization it is bad because it means you will only use those few addresses which are not good for privacy. Also you shouldn’t rely on memory as you could make a mistake and send to a wrong address still even if it is not that of the scammer

[CryptSafe]

It is very much important that one needs to cross check their details before any possible actions of initiating a transfer because the virus is very tricky. I have had such experience before where I almost approved a transaction but I was curious to check again for myself when I noticed a change in the wallet address I had to cross check with my previous transaction to see for myself and that was when I realised my gadget got infiltrated by the clipboard virus. I had to format my gadget. Then start afresh reinstallation.

It is advisable to do well confirm and reconfirm your details before you approve of any transaction when it comes to huge funds involved. This measures would save you the stress of losing funds to scammers and to also take note of any changes in your gadgets when it comes to initiate transaction.

[LoyceV]

They can actually clone almost a full address with just maybe a two or three characters missing from it.

The only way to do that, is by creating a burn address. There's no profit for a scammer who burns the money he steals.

This is possible with vanity address generators.

Try it. Address 1FeexV6bAHb8ybZjqQMjJrcCrHGW9sb6uF holds 79,957.26462896BTC. I'll make it easy on you: instead of 3 missing characters, try to create an address with 15 missing characters. You'll realize that what you suggested is not possible.

[DYING_S0UL]

They can actually clone almost a full address with just maybe a two or three characters missing from it.

The only way to do that, is by creating a burn address. There's no profit for a scammer who burns the money he steals.

This is possible with vanity address generators.

Try it. Address 1FeexV6bAHb8ybZjqQMjJrcCrHGW9sb6uF holds 79,957.26462896BTC. I'll make it easy on you: instead of 3 missing characters, try to create an address with 15 missing characters. You'll realize that what you suggested is not possible.

He may be referring to address poisoning. Where the last part may be similar to the original address. I can't remember where but I may have came across such a topic.

Found it: https://support.metamask.io/hc/en-us/articles/11967455819035-Address-poisoning-scams

I knew about token burning but never knew address burning was possible. New days, new things to learn. You have any thread regarding address burning? Would appreciate very much.

[Bushdark]

Since I come to realize that there is thing called clipboard virus which can change the address halfway I have started checking address in middle as well.

My revolution:

copy-paste address blindly >> check first letters >> check first and last letters >> current stage: check first-middle-end letters

I hope it doesn't come to stage where you have check whole address letter by letter  

I don't really have an ides in what clipboard virus actually means and how one can contract it. I think I just have to be very careful on how I download files online and send it to my system. It might be very difficult for one to know how this virus actually get into system but time will te for us to have idea on what this actually means. There is no way this virus can be eradicated then it might be that even formatting the system does not actually take away the virus entirely from the system.

[Hamza2424]

Hmm, interesting also thanks Op for mentioning this, currently I'm using the third-party clipboard to save time while working with data, I'll make sure to uninstall it because I've some of the active hot wallets working on my same PC. Seems like there's something OP hasn't tracked out because even after reading the full post i cant figure out how OP's system got infected. Here in my case, there's no incident yet but as I'm using third-party clipboard software there are some vulnerabilities.

These days I've encountered 2 stories back to back covering the hacking using the rubber ducky, so what I want to mention is dont be careless and make sure of a healthy environment while working with finance-related data and applications. Prefer a hardware wallet more suitable if you can afford it.

[libert19]

~

I don't really have an ides in what clipboard virus actually means and how one can contract it. I think I just have to be very careful on how I download files online and send it to my system. It might be very difficult for one to know how this virus actually get into system but time will te for us to have idea on what this actually means. There is no way this virus can be eradicated then it might be that even formatting the system does not actually take away the virus entirely from the system.

Basically, it changes crypto address, suppose you are transferring funds to your other account having address 'abc..' and you copied this address into your clipboard then this virus would change it to hacker's address, 'adc' — if you are not careful enough you will confirm it under the illusion that it's the address you are sending to (I hope you recognized 'c' in hacker's address  ).

[pinggoki]

That could be the answer since, I recently got this device. So a lot of software had to be reinstalled. But that's not what I'm worrying about. I worry about windows defender not detecting it. And it's not that I got infected and the very moment I noticed it. I think I was infected for more then 10 days. There was no way of knowing, until I tried to make a transaction and made this discovery. That's what I don't like about it. This sly virus, not showing up anywhere until someone tried something related to crypto.

Have you checked on any of your recent programs that you've downloaded? There's a possibility that the reason why the Windows Defender didn't detect this is probably because it's a Trojan and an advance one at that as Windows Defender is already a good antivirus program so you can probably check on the previous downloads that you've done. Is this virus only a thing for computers? Or is it on mobile too? It's a scary thing for me because I'm not really checking too much on which address I would send my bitcoin so I'm a likely victim to this, good thing I don't do a lot of transactions.

[Pandu Geddon]

That could be the answer since, I recently got this device. So a lot of software had to be reinstalled. But that's not what I'm worrying about. I worry about windows defender not detecting it. And it's not that I got infected and the very moment I noticed it. I think I was infected for more then 10 days. There was no way of knowing, until I tried to make a transaction and made this discovery. That's what I don't like about it. This sly virus, not showing up anywhere until someone tried something related to crypto.

Have you checked on any of your recent programs that you've downloaded? There's a possibility that the reason why the Windows Defender didn't detect this is probably because it's a Trojan and an advance one at that as Windows Defender is already a good antivirus program so you can probably check on the previous downloads that you've done. Is this virus only a thing for computers? Or is it on mobile too? It's a scary thing for me because I'm not really checking too much on which address I would send my bitcoin so I'm a likely victim to this, good thing I don't do a lot of transactions.

if it applies to mobile phones it will be very easy when newly installed applications will of course require approval for some access on the smartphone.
applications downloaded from official sites may have very little risk. but on a PC or other device, we often download and install applications provided by other developers.

If a virus has been detected, reinstalling your device is the most appropriate choice to clean everything. As OP experienced, it's possible that the antivirus really didn't detect the virus until we realized when it was connected to a crypto wallet. and the situation is just waiting for us to be careless.

[pinggoki]

~

if it applies to mobile phones it will be very easy when newly installed applications will of course require approval for some access on the smartphone.
applications downloaded from official sites may have very little risk. but on a PC or other device, we often download and install applications provided by other developers.

There are some stuff that can easily bypass through a phone's security and even on the app store that are supposedly safe for you to download on stuff, you can see some apps that can bypass through that are Trojan. You also can never be sure of official sites because there are scammers that imitates the official website and pays top dollar to get on top of the search engine results which buries the official site on 3rd or 4th place in the results. The best thing to do is to double or triple check so you are sure that something isn't fishy.

~

If a virus has been detected, reinstalling your device is the most appropriate choice to clean everything. As OP experienced, it's possible that the antivirus really didn't detect the virus until we realized when it was connected to a crypto wallet. and the situation is just waiting for us to be careless.

Nope, reformat is the best thing to do if there's a potential that you've downloaded a virus together with an app, that's the only way to remove the virus and be sure that reuse of the computer is clean slate. Virus don't go away just because you've deleted the file that it came with because some of them install themselves somewhere that's different from the destination of the file that they've been with.