This week’s cybersecurity events were once again closely tied to cryptocurrencies: attackers promoted a clipper through fake reputation on GitHub and YouTube, a USB worm spread via hidden Windows shortcuts, and researchers found a new Android trojan for stealing digital assets. These episodes clearly illustrate which cybersecurity trends will be especially prominent in 2026: attacks on trust in public platforms, data theft via mobile apps, use of AI in social engineering, and protection of crypto wallets from address replacement.
Main episodes of the week:
Crypto Clipper — disguised as trading and betting tools, with trust boosted by fake likes, comments, and downloads.
USB Worm — infected Windows systems via .LNK files on flash drives and replaced crypto wallet addresses in the clipboard.
Crypto Laundering Network — 23 people were arrested in South Korea in a case involving the transfer of funds for a Cambodian phishing syndicate.
Android Trojan Rokarolla — Zimperium experts described malware with full device control capabilities.
Fake Reputation Helped Promote Crypto Clipper
An unknown attacker launched a large-scale malware distribution campaign using techniques similar to legitimate marketing. Check Point Research described this approach as creating a fake “reputation economy”: the appearance of popularity and trust was built around malicious files in advance.
The main goal of the campaign was to install crypto clippers on victims’ devices disguised as trading software in the Solana ecosystem and as betting prediction tools. For the information security field, this is a telling case: attackers are increasingly targeting not only code vulnerabilities but also users’ trust in public platforms.
The clipper itself is written in Rust and designed for Windows and macOS. After installation, it silently monitors the clipboard. If a user copies a cryptocurrency wallet address, the malware instantly replaces it with the attacker’s details, causing the transfer to go to the criminal instead of the intended recipient.
To lull the vigilance of crypto investors and online gamers, the campaign’s author built a network of fake accounts on various platforms. Analysts noticed coordinated activity on VirusTotal: dozens of profiles left positive comments and likes, creating the impression that the malicious files were safe.
- On GitHub and SourceForge, the attacker used a network of accounts to mutually promote repositories. On SourceForge, the number of downloads was artificially inflated to 44,000 using an Android device farm.
- On YouTube, a channel with more than 91,000 subscribers was used to advertise the programs. Tutorial videos were voiced by AI voice generators, and fake positive comments appeared under the videos.
- Press release distribution services, including EIN Presswire, were used to give the tools a legitimate appearance. Such publications were then automatically picked up by partner news sites.
Check Point Research believes that manipulation on crowdsourcing platforms signals a new dangerous stage of social engineering. If this model takes hold, it could be used not only for clippers but also for mass distribution of ransomware and more advanced info stealers.
USB Worm Infected Computers Through Hidden Windows Shortcuts
Microsoft revealed details of a campaign involving a self-replicating malware that targeted cryptocurrencies. Infection began when a user opened a modified .LNK shortcut on a USB drive.
After launch, the worm downloaded additional components from a command server in the .onion zone. It then searched the computer for user documents, hid the originals, and replaced them with malicious shortcuts of the same name. As a result, the program was activated every time the device owner tried to open a familiar work file.
To spread, the malware created a scheduled task that monitored for the connection of external drives. As soon as a new flash drive was inserted, the worm immediately copied itself onto it. This scenario is reminiscent of old attacks via removable media, but this time it was adapted for cryptocurrency theft.
The stealer only started working if Task Manager was not open on the system. It established a connection with the command server via an embedded Tor executable and checked the clipboard every half second. It targeted:
- BIP39 seed phrases of 12 or 24 words.
- Bitcoin wallet addresses: Legacy, P2SH, Bech32, and Taproot.
- Ethereum, Tron, and Monero wallet addresses.
When a user copied a wallet address, the program replaced it with the attacker’s address. To make the substitution less noticeable, the algorithm selected credentials with similar starting characters.
The malware did not limit itself to intercepting the clipboard. Every ten seconds, it took five screenshots and sent them to the operators via Curl. By server command, the program could download and execute any JavaScript script on the infected machine.
Activity from this USB worm has been recorded since at least February. Microsoft emphasizes that the most noticeable signs of infection are related not to signatures but to system behavior: suspicious background activity, unexpected launches of Curl, PowerShell, and network connections to localhost:9050 — the standard Tor proxy port.
Crypto Laundering Network Shut Down in South Korea
South Korean law enforcement detained 23 suspects in a case involving laundering funds for a Cambodian phishing group. According to investigators, the money was moved through a complex chain of transactions involving local and foreign crypto exchanges.
From February 2024 to April 2025, participants in the scheme moved about 11.1 million USDT. The infrastructure was large: about 11,300 accounts were used for operations. These transit accounts were linked to stolen funds totaling about $17 million, resulting from 265 incidents.
During raids, police seized criminal proceeds amounting to 650 million won, or about $430,000. The operation is still ongoing: the alleged organizer remains at large. A Red Notice has been issued by Interpol, which involves an international search and possible extradition.
Rokarolla Gains Full Control Features Over Android
Zimperium specialists discovered the Android trojan Rokarolla, aimed at stealing cryptocurrencies. Its arsenal includes 137 remote commands. This set allows it to intercept PIN codes, read and send SMS, manage the clipboard, and disable built-in OS security mechanisms.
The malware spreads through sites masquerading as download pages for popular services like TikTok and Google Chrome. In the first stage, the victim installs an app that looks like a system component of Google Play Protect. Then, using social engineering, the dropper convinces the user to grant access to “Accessibility.”
Once this permission is granted, the malware deploys its main payload and immediately disables the real Play Protect scanner. For mobile device security, such permissions remain among the riskiest elements: they give the app too much control over user actions.
Rokarolla downloads fake HTML authorization pages from the server for each active app on the target list. When the smartphone owner opens a real crypto wallet, the trojan overlays it with a fake window and steals the entered data.
A separate overlay copies the standard Android lock screen. This allows the malware to steal PIN codes, passwords, or pattern keys, and operators can control the device even after it is locked. To steal cryptocurrencies, the trojan also uses a clipper: it monitors the clipboard and changes copied wallet addresses to the attacker’s details.
To bypass two-factor authentication, Rokarolla reads all SMS on the device and can send messages itself. If the trojan becomes the default app for calls and SMS, it can block incoming calls. In this case, a warning call from a bank’s anti-fraud system simply does not reach the owner.
The main expert recommendation is to be especially careful when granting access to “Accessibility.” This permission triggers the main attack chain and turns an ordinary app into a tool for full control over the smartphone.
Crypto Scammers Start Sending Couriers for Cash
Operators of cryptocurrency “pig butchering” schemes have begun hiring couriers to collect cash from victims. This method helps bypass banking security systems that might block suspicious transfers.
Usually, scammers start by communicating via social networks, messengers, or dating sites. They gradually build trust and then offer to invest in a fake investment platform. If a bank transfer fails, the victim is convinced to withdraw cash — for example, under the pretext of a temporary “account freeze.”
After this, a courier is sent to the person. For identification, a pre-agreed password or the serial number of a specific dollar bill is used. After receiving the money, the scammers show the victim’s virtual wallet balance increasing, then demand more payments — supposedly to pay taxes before withdrawing funds.
According to the FBI for 2025, cryptocurrency and investment schemes remain the most destructive form of cybercrime in the US. They accounted for 49% of all incidents, with total losses reaching $8.6 billion.
Apple Closes Dangerous Vulnerability in Beats Studio Buds
Apple released a firmware update for Beats Studio Buds and fixed a high-severity vulnerability. SentinelOne experts reported the issue back in January: the flaw allowed attackers to secretly connect to the headphones and use their microphone for eavesdropping.
The vulnerability was assigned the identifier CVE-2025-20701. It is related to improper authorization in the Bluetooth audio SDK from chip developer Airoha. If the headphones were not yet paired and were in pairing mode, an attacker within Bluetooth range could connect their equipment without the user’s consent.
The issue was fixed in Beats firmware version 1B211. The exploit could be triggered via regular Bluetooth or Bluetooth Low Energy without any authentication. In addition to eavesdropping, the attack gave almost full control over the device: the attacker could read and overwrite the headphones’ RAM and flash memory.
Moreover, attackers could intercept trusted connections with previously paired smartphones. This opened the way for more complex multi-stage attacks, where information technologies like wireless protocols became part of the compromise chain.
Events, Incidents, and Basic Principles of Cybersecurity
An information security event is a recorded action or change that can affect the protection of a system or data. For example, connecting a USB drive, launching an unusual process, logging in from a new device, changing access rights, or a network connection to a suspicious node.
A cybersecurity incident is an event or chain of events that already violates security or creates a direct threat. Such incidents include infection by a USB worm, replacement of a crypto wallet address in the clipboard, theft of a seed phrase, phishing authorization via a fake window, and unauthorized Bluetooth connection to a device.
Three basic principles of cybersecurity:
- Confidentiality — only those who truly need access to data receive it.
- Integrity — data should not be secretly changed, replaced, or damaged.
- Availability — systems and services should work when users and businesses need them.
Infrastructure protection is built around updates, access control, monitoring suspicious processes, checking network connections, and careful handling of external drives. Data protection relies on backups, encryption, multi-factor authentication, minimal privileges, and careful verification of where money or confidential information is sent.
Cybersecurity Rules for Users
10 rules to help reduce the risk of hacking and data theft:
- Use different complex passwords for important services.
- Enable multi-factor authentication where available.
- Check the website address before entering a login, password, or seed phrase.
- Do not install apps from questionable sources.
- Be careful when granting access to “Accessibility” and other sensitive permissions.
- Do not open files and shortcuts from unfamiliar USB drives.
- Update your operating system, browser, apps, and device firmware.
- Before a crypto transfer, verify the wallet address after pasting from the clipboard.
- Store backups of important data separately from the main device.
- Do not trust a project’s popularity based only on likes, comments, downloads, or video reviews.
7 Rules for Safe Internet Use
- Do not click suspicious links from emails, messengers, or comments.
- Do not enter payment data and passwords on pages that look unusual.
- Check the site domain, especially when it comes to wallets, exchanges, and investments.
- Do not send money to people you met on social networks or dating sites.
- Do not download “investment” and “trading” tools from unverified pages.
- Do not share codes from SMS, PIN codes, or seed phrases with third parties.
- Be cautious with urgent requests, promises of high returns, and pressure from the interlocutor.
Employee Training and Finding Cybersecurity Events
It is useful to train employees not with one-off lectures, but with short regular practices. Reviewing real attacks, phishing email drills, instructions for handling USB drives, checklists for crypto payments, response scenarios for suspicious apps, and clear rules for granting access rights work well.
Calendars of conferences and cybersecurity events can be found on the websites of professional associations, major cybersecurity vendors, technology media event sections, university pages, and professional communities. Before registering, it is useful to check the organizer, date, program, participation format, and speaker list.
Other Important News of the Week
Aztec — an outdated contract on the network was hacked for $2 million.
Polymarket — Kentucky filed a lawsuit against the platform, following other states.
Social Networks in the UK — authorities plan to ban access for children under 16.
Cryptocurrency in Russia — the Supreme Court recognized it as an object of theft.
Bitbank — the exchange threatened to block transactions related to Polymarket.
What to Read on the Weekend
Ideas that change the world are often born on the periphery — among people whom contemporaries consider eccentrics. ForkLog explores why pioneers like Jack Parsons often remain in the shadows of revolutions they themselves helped spark. Artificial intelligence is already influencing cybersecurity from both sides: defenders use it to spot anomalies faster, detect malicious activity, and analyze large data sets, while attackers use it to simplify phishing, generate fake voices, and create convincing lures. Such stories are a good reminder: technological shifts rarely start at the center of attention.
{
“@context”: “https://schema.org”,
“@type”: “Article”,
“about”: [
{
“@type”: “Thing”,
“name”: “information security”
},
{
“@type”: “Thing”,
“name”: “computer security”
},
{
“@type”: “Thing”,
“name”: “artificial intelligence”
}
]
}
