X-Industry

Crypto Clipper is a trojan deployed via USB storage devices that has been affecting users since February 2026.  It looks for clipboard data and other valuable assets, predominately associated with Crypto wallet addresses, and exfiltrates this information with Clipper malware.

It does this through a bundled Tor proxy, using Windows Script host and ActiveX logic, to connect to a hidden C2 server, carrying out high frequency clipboard theft, collecting screenshots, and running crypto wallet address

Spynote is a Remote Access Trojan that initially surfaced in 2020.  Since then, it has grown into one of Android's most common malware families, with multiple samples, integration of other RATs (e.g., CypherRat), and a large family of over 10,000 samples. There are numerous variants and integrations of other RATs, and since 2023, there has been a growing interest in financial institutions.

On 1 February 2024, analysts found a malicious sample posing as a legitimate crypto wallet that included th