Researchers Uncover Keona Clipper Malware Used For Diverting Crypto Payments

Researchers from Cyble have discovered a new Clipper malware called Keona Clipper.

The Clipper malware is able to redirect payments in cryptocurrencies to wallets controlled by attackers. To do this, Keona Clipper constantly monitors the contents of a user’s clipboard and searches for cryptocurrency wallets.

Clipper malware is usually distributed in the form of trojanized applications that can be downloaded from the internet. The aim of the malware is to steal money or financial details by exploiting the Windows clipboard.

Keona Clipper was developed in the .NET programming language and protected by Confuser 1.x. Researchers identified more than 90 different Keona samples since May 2022, showing wide deployment.

Once executed, the malware notifies an attacker-controlled Telegram bot via the Telegram API. In situations where the computer is restarted, the malware also ensures that it is always running. This is achieved by creating autostart entries in the Windows registry.

To ensure persistence, the malware copies itself to several locations, including the Administrative Tools folder and the Startup folder.

After deployment, Keona Clipper silently monitors each clipboard and uses regular expressions to search for crypto wallets. As soon as a wallet is found, it is immediately replaced in the clipboard by a wallet address provided by the attacker.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web