MalwarePublished 19 Jun 2026

Cybercriminals abused GitHub, YouTube and VirusTotal to push crypto-stealing malware

Source Reddit Cybersecurity

Discussion

Cybercriminals conducted a campaign abusing GitHub, YouTube, and VirusTotal to distribute crypto-stealing malware disguised as legitimate cryptocurrency trading and gambling tools. The malware, targeting Windows and macOS, is a Rust-based clipboard hijacker that replaces copied cryptocurrency wallet addresses with attacker-controlled ones. The campaign used fake GitHub stars, coordinated accounts, inflated download counts, AI-narrated YouTube tutorials, and manipulated VirusTotal feedback to build trust and appear legitimate. Over 5,000 GitHub downloads and more than 44,000 SourceForge downloads were recorded, with significant activity from Pakistan and India. The attackers frequently rotated wallet addresses to evade detection. The campaign demonstrates advanced reputation manipulation techniques to spread malware beyond classic distribution methods.

r/cybersecurity (opens in a new tab)u/sunychoudhary0 points0 comments

https://www.helpnetsecurity.com/2026/06/19/fake-github-stars-crypto-stealing-malware/

Links cited in the discussion

https://www.helpnetsecurity.com/2026/06/19/fake-github-stars-crypto-stealing-malware/

Impact

The malware steals cryptocurrency by hijacking clipboard data and substituting victim wallet addresses with attacker-controlled ones, potentially resulting in direct financial loss for victims. The campaign's use of multiple popular platforms and reputation manipulation increases the likelihood of victim infection. The frequent rotation of attacker wallets complicates tracking and mitigation efforts. The campaign affected both Windows and macOS users and achieved significant download volumes, indicating a broad impact. No direct evidence of exploitation in the wild beyond the campaign is provided.

Defensive guidance

Defenders should rely on threat intelligence indicators of compromise (IOCs) published by Check Point to detect related activity. Users should exercise caution when downloading cryptocurrency tools from GitHub, SourceForge, or other platforms, especially those with suspiciously high popularity metrics or promoted via unverified channels. Avoid using software promoted through manipulated reviews or AI-narrated tutorials without independent verification. Employ endpoint protection capable of detecting clipboard hijackers and monitor for unexpected wallet address substitutions. Since this campaign exploits trust and reputation systems, awareness and user education are critical.

Summary

This malware campaign involved distributing Rust-based clipboard hijackers through multiple platforms including GitHub, YouTube, VirusTotal, SourceForge, and a WordPress phishing site. The malware targets Windows and macOS systems, monitoring clipboard content for cryptocurrency wallet addresses and replacing them with attacker-controlled addresses from a large internal list of over 15,500 wallets across various cryptocurrencies. The attackers used coordinated fake accounts ('Ghost Networks') to inflate GitHub stars, forks, and download counts, and manipulated VirusTotal comments and votes to appear trustworthy. YouTube videos with AI-generated narration demonstrated the malicious tools to potential victims, further enhancing credibility. The campaign recorded thousands of downloads and showed geographic download anomalies, suggesting use of device farms to inflate metrics. Wallet addresses were frequently rotated to avoid detection after theft. This operation highlights evolving tactics in malware distribution leveraging reputation systems and cross-platform promotion.

References

Community reviews

Loading reviews…

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 19 Jun 2026, 13:05 UTC

Technical details

References

Community reviews

Related threats