CampaignPublished 15 Jan 2026

HUMINT Operations Uncover Cryptojacking Campaign: Discord-Based Distribution of Clipboard Hijacking Malware Targeting Cryptocurrency Communities

Source AlienVault OTX General

Description

A sophisticated cryptocurrency theft operation, orchestrated by the threat actor 'RedLineCyber', has been uncovered. The actor distributes a malicious executable named 'Pro.exe', a Python-based clipboard hijacking trojan designed for silent cryptocurrency theft. This malware continuously monitors the Windows clipboard for cryptocurrency wallet addresses and substitutes them with attacker-controlled addresses. The threat actor exploits trust within Discord communities focused on gaming, gambling, and cryptocurrency streaming. The malware demonstrates moderate technical complexity, using obfuscated Python bytecode and base64-encoded regular expressions for wallet detection. It targets cryptocurrency streamers, casino gaming communities, and users who frequently handle digital asset transactions during live broadcasts. The operation has successfully compromised multiple victims across six major cryptocurrencies.

Impact

For European organizations, especially those involved in cryptocurrency trading, streaming, gaming, or online gambling, this campaign poses a significant financial risk. Clipboard hijacking malware can silently redirect cryptocurrency transactions without the victim's knowledge, leading to direct financial losses. The exploitation of Discord communities, which are widely used across Europe for gaming and crypto discussions, increases the likelihood of infection and spread. Organizations hosting or sponsoring cryptocurrency streamers or gambling platforms may face reputational damage if their users are compromised. Additionally, the malware's persistence mechanisms could allow prolonged unauthorized access, potentially enabling further attacks or data theft. The campaign's targeting of six major cryptocurrencies means that a wide range of digital assets are at risk. Given Europe's growing adoption of cryptocurrencies and active online gaming communities, the financial and operational impacts could be substantial. Moreover, the social engineering aspect complicates detection and prevention, as users may trust links or files shared within their communities. This threat could also affect European cryptocurrency exchanges indirectly if users' wallets are compromised, leading to increased support costs and potential regulatory scrutiny. The medium severity rating reflects moderate technical complexity and impact, but the stealthy nature of clipboard hijacking and social engineering vector elevates the risk profile for affected entities.

Defensive guidance

1. Implement endpoint detection and response (EDR) solutions capable of detecting obfuscated Python bytecode and clipboard monitoring behaviors. 2. Deploy application whitelisting to prevent execution of unauthorized binaries like 'Pro.exe'. 3. Educate users, especially those in cryptocurrency, gaming, and streaming communities, about the risks of downloading executables from untrusted Discord links or messages. 4. Monitor clipboard activity on critical systems and alert on suspicious modifications of cryptocurrency wallet addresses. 5. Use multi-factor authentication and hardware wallets for cryptocurrency transactions to reduce reliance on clipboard copy-paste. 6. Regularly audit autorun and persistence mechanisms on Windows systems to detect unauthorized entries. 7. Collaborate with Discord community moderators to identify and remove malicious actors and links. 8. Employ network monitoring to detect unusual outbound connections or data exfiltration attempts associated with the malware. 9. Maintain updated threat intelligence feeds incorporating the provided file hashes to block known malware samples. 10. Encourage cryptocurrency users to manually verify wallet addresses before completing transactions, especially when copied from clipboard. 11. Limit user permissions to reduce malware persistence capabilities. 12. Conduct regular phishing and social engineering awareness campaigns tailored to the gaming and crypto communities.

HUMINT Operations Uncover Cryptojacking Campaign: Discord-Based Distribution of Clipboard Hijacking Malware Targeting Cryptocurrency Communities

Description

Impact

Defensive guidance

Indicators of compromise

Hashes 4

Community reviews

Description

AI analysisMachine-generated, updated 16 Jan 2026, 13:51 UTC

MITRE ATT&CK techniques5 from threat tags

Technical details

Indicators of compromise

Hashes 4

Community reviews

Related threats