ClipXDaemon Malware, a Stealthy Cryptocurrency Clipboard Hijacker on Linux Researchers identified ClipXDaemon, a Linux clipboard hijacker that targets cryptocurrency users by monitoring X11 clipboards and replacing copied wallet addresses with attacker-controlled ones to redirect funds. The loader resembles ShadowHS samples due to use of the open-source bincrypter framework, but ClipXDaemon operates C2-less, persists via ~/.profile, and uses process masquerading and...

ClipXDaemon malware targets Linux users by hijacking X11 clipboards, swapping crypto wallet addresses with attacker-controlled ones. It uses process masquerading, operates C2-less, and persists via ~/.profile. #ClipHijacker #LinuxThreat