Malware & Tooling · Financial Fraud
Fake Reputation Now Sells Crypto Malware The lure is no longer just a shady download. This campaign sells trust first, using fake stars, ratings, views, and “safe” comments to make crypto tools look vetted on GitHub, SourceForge, YouTube, and VirusTotal before the payload ever runs.
Check Point ties the operation to a WordPress phishing site, public code-hosting projects, a YouTube promo channel, and reputation abuse on VirusTotal. The payloads are Rust-based clipboard hijackers for Windows and macOS that watch for wallet addresses and swap in attacker-controlled ones, with the campaign aimed at Solana traders, crash-game gamblers, and other users chasing quick-profit tools.
The risk is broader than this one clipboard stealer. Once attackers can manufacture trust across popular platforms, the same distribution model can carry stealer or ransomware payloads under a believable reputation trail.
5 sources · Jun 19
Timeline Sources Jun 19 Help Net Security
Cybercriminals abused GitHub, YouTube and VirusTotal to push crypto-stealing malware - Help Net Security
Crypto-stealing malware hid behind fake GitHub stars, YouTube tutorials and favorable VirusTotal comments.
original Jun 18 Infosecurity Magazine
Fake GitHub Stars and AI Videos Mask a Crypto Clipper
A Rust crypto clipper hides behind fake GitHub stars and AI-narrated YouTube videos
original Jun 18 The Hacker News
Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments
Check Point says a Rust-based crypto clipper is being promoted through fake reviews, GitHub, SourceForge, YouTube, and paid news posts.
original Part of the PlainSec briefing for 2026-06-18
Every edition of this story: Fake Reputation Now Sells Crypto Malware
More from today Malware & Tooling · Financial Fraud
Fake Reputation Now Sells Crypto Malware The lure is no longer just a shady download. This campaign sells trust first, using fake stars, ratings, views, and “safe” comments to make crypto tools look vetted on GitHub, SourceForge, YouTube, and VirusTotal before the payload ever runs.
Check Point ties the operation to a WordPress phishing site, public code-hosting projects, a YouTube promo channel, and reputation abuse on VirusTotal. The payloads are Rust-based clipboard hijackers for Windows and macOS that watch for wallet addresses and swap in attacker-controlled ones, with the campaign aimed at Solana traders, crash-game gamblers, and other users chasing quick-profit tools.
The risk is broader than this one clipboard stealer. Once attackers can manufacture trust across popular platforms, the same distribution model can carry stealer or ransomware payloads under a believable reputation trail.
5 sources · Jun 19
Timeline Sources Jun 19 Help Net Security
Cybercriminals abused GitHub, YouTube and VirusTotal to push crypto-stealing malware - Help Net Security
Crypto-stealing malware hid behind fake GitHub stars, YouTube tutorials and favorable VirusTotal comments.
original Jun 18 Infosecurity Magazine
Fake GitHub Stars and AI Videos Mask a Crypto Clipper
A Rust crypto clipper hides behind fake GitHub stars and AI-narrated YouTube videos
original Jun 18 The Hacker News
Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments
Check Point says a Rust-based crypto clipper is being promoted through fake reviews, GitHub, SourceForge, YouTube, and paid news posts.
original Part of the PlainSec briefing for 2026-06-18
Every edition of this story: Fake Reputation Now Sells Crypto Malware
More from today