[TEST] [General] Crypto scams, attacks and malware

[Mitchell]

What is a General thread?

This is the another of (probably) many general threads that will be created in this subsection. A General thread will contain relevant information related to the question/subject of the title thus duplicate threads related to it are not allowed. That means no new topics for scams, attacks, malware, phishing, clipboard hijacking, wrench attacks, and the like in this section. Post it in this thread instead.

Posts within a general thread will be harshly moderated and anything remotely useless will be removed. These threads are supposed to be informational, and reposting similar information multiple times is not allowed. You are free to discuss information that has been posted, but keep it short and civil (more than 5 replies is too much).

Questions about information provided in this thread are not allowed either. For example, a post like the one below will be removed as we are not here to babysit. Please do your own research and look in the appropriate sections for answers.

Is this malware real? Can someone check if my PC is infected?

What are General threads for?

General threads are meant to be used as an overview of useful information and to prevent unnecessary duplicate threads within the section. After 10 pages this thread will be closed and a "[General] Crypto scams, attacks and malware - Part n+1" will be created, which will contain an updated list of good information. This process will constantly be repeated. The reason that this approach was chosen is to prevent long threads in which people don't find what they are looking for and to provide the most up-to-date information.


Overview - Table of contents
Click the link to go to that part of the post

Malware and stealers
Clipboard and address hijacking
Telegram, email and social engineering
Physical (wrench) attacks
How to spot scams / related education


Malware and stealers

Plenty of malware going after crypto users. Only download stuff from official sources. Don't run random install commands from ads, DMs, or "fix" pages.

• Fake Mac Clipboard App Delivers New Password-Stealing Malware: fake Maccy clipboard app (PamStealer). Steals passwords and more.
• CrashStealer: New MacOS information/crypto stealer: another macOS stealer.
• OkoBot: new sophisticated malware framework targets cryptocurrency users: Kaspersky write-up. Has a SeedHunter module that goes after hardware wallet seed entry.
• ClickLock Stealer: Another crypto stealer malware on MacOS: ClickFix-style. Goes after browsers, wallet extensions, desktop wallets, password managers, etc.
• New macOS malware with AI linked to North Korean hackers targeting crypto users: social engineering first (Telegram / fake calls), then they drop malware.
• RatOn trojan with function for account takeover of crypto wallets: Android banking trojan. Overlay + auto-transfer + NFC relay. Hits MetaMask, Trust, Blockchain.com, Phantom, etc.
• [PSA]: PXA Stealer targets crypto wallets and other financial data: PXA Stealer. Harvests wallets / financial data, sold on via Telegram.
• BTC Investor Losses 7,4 BTC with Fake Sparrow Wallet Mobile App: fake Sparrow Wallet app on the App Store. Seed import = gone.
• Just a friendly reminder, cold wallet vs hardware wallet, Windows malware: why a proper hardware wallet still matters.

Clipboard and address hijacking

Malware can swap the address you copied. Always check the full address before you send.

• Why You Shouldn't Trust Your Clipboard [Practical]: practical example of clipboard swapping.

Telegram, email and social engineering

Same old crap, different day. Nobody can pull seed phrases off the blockchain. Non-custodial wallet teams are not emailing you out of nowhere with "recovery" or "security" links either.

• Scammer on telegram who claims to search blockchain for forgotten wallets: Telegram scam. Paid "search" for forgotten wallets / seeds. Not a thing.
• Yet another TelegramXfragment scammer!: Telegram / Fragment scam. Still catching beginners.
• Wallet scam email: phishing email pretending to be a wallet team.
• Crypto owner losses ≈ $1 million after fake job interview: fake partnership / job interview social engineering. ~$1M gone.

Physical (wrench) attacks

OpSec isn't only an online problem. People get robbed for crypto IRL too.

• CertiK Intel3D H1 2026 Wrench Attacks: CertiK H1 2026 numbers / infographic.
• Another example on why we should be quiet and not flaunt our crypto in public: Amouranth home invasion / crypto robbery attempt. Don't advertise holdings.

How to spot scams / related education

Useful background. Don't open a new "beware of scams" topic. Post here if you've got something specific worth adding.

• [EDU] How to spot scams online - V2: common scam types.
• Discussion! Don't BUY FAKE! "wallet.dat" files with lost passwords.: don't buy "lost password" wallet.dat files. Share hashes / findings if it helps others.

Note: Please do not create posts such as "I think this is a great idea" as they are insubstantial and will be removed. New scam / attack / malware topics in this section will be locked and possibly moved to Trashcan. Post them in this General instead. Feel free to report any topics we missed in the last 10 pages (all the topics listed here will only be locked, since they are relevant).

Disclaimer: For general information only. Use at your own risk. Not financial, legal, or security advice. Do your own research.