Clipboard hijacker malware ani address poisoning attack: ka crypto wallet walima IBAN ɲɔgɔn falen-falen paste kan, ka cɛmancɛ ni laban taamasiyɛnw sɛgɛsɛgɛ¶

Ni i ye kriptowari waribɔ ladɛrɛsi dɔ kopi kɛ (BTC, . ETH, . USDT, . SOL, . TRX) walima diɲɛ banki jatebɔsɛbɛn nimɔrɔ dɔ ( .IBAN / . SWIFT / . ABA) ani ka paste ( ) digi ( .Ctrl+V walima Cmd+V), bagabagali danfaralen fila bɛ se k’i ka nafolo bila makun na ka taa kojugukɛlaw ka tɔnba dɔ la: sigida Clipboard Hijacker ("Clipper") Malware min bɛ baara kɛ i ka ɔridinatɛri hakili la min bɛ sɛbɛnniw falen i ka sistɛmu clipboard kɔnɔ milisekɔndi 5 jukɔrɔ, walima cakɛda Vanity Address Poisoning Attack min bɛ i ka waribɔsɛbɛn jago tariku nɔgɔ ni counterfeit lookalike address matching the fɔlɔ 4 fo 6 ani laban 4 fo 6 taamaʃyɛn i ka taa yɔrɔ lakika la. Nin gafe in bɛ fɛɛrɛ teliyalenw di walasa ka blockchain walima wire jago minnu bɛ senna, olu tiɲɛ, ka sigida ka kunnafonidilanw kɔlɔsili porogaramu juguw dɔn ani k’u bɔ yen, ani ka yɔrɔ ladɛrɛsi kelen-kelen bɛɛ cɛmancɛ sɛbɛnniw sɛgɛsɛgɛ sani i ka i bolonɔ bila fɛnɲɛnamafagalanw ka waribɔlan ekran kan.

Aw bɛ nin kɛ sisan¶

1. A ɲini ka Nonce Replacement (Speed Up / Cancel) ni kriptowari jago dɔ bɛ mempool kɔnɔ hali bi. I ka waribɔsɛbɛn da wuli (MetaMask, . Rabby, . Ledger Live, . Electrum, . Sparrow) ani k' a lajɛ ni jagokɛcogo bɛ Pending / Unconfirmed hali bi. Ethereum ni EVM cakɛdaw kan, i ka Cancel digi o yɔrɔnin bɛɛ (walima ka a ci 0 ETH jago kɛli i yɛrɛ ka ladɛrɛsi la ni Custom Nonce kelen tigitigi ye ni Priority Gas Fee ye min ka ca ni kɛmɛsarada la 30 ye). Bitcoin kan, aw bɛ Replace-By-Fee (RBF) cancellation ka donnakow bila sira ka segin i yɛrɛ ka portefeuille kɔnɔ sanni bloki nata ka minɛ.
2. Aw bɛ aw ka banki ka telefɔni nanbaratɔn wele joona ni an IBAN, . ABA, walima Sort Code was swapped on paste. Ni clipboard malware ye banki jatebɔsɛbɛn nimɔrɔ nɔrɔlen dɔ Changé sokɔnɔ fili dɔ kan, SWIFT transfert, walima SEPA wari sarali, i ka banki ka nanbara sira wele walima i ka sigida kɔrɔtɔko nimɔrɔ (911 Ameriki ani Kanada, 112 Erɔpu tɔnba bɛɛ kɔnɔ, 999 Angletɛri) walasa ka polisiw ka kojugubakɛlaw ka nimɔrɔw sɔrɔ aw ye a lajɛ kɔrɔtɔko nimɔrɔw ka ɲɛsin diɲɛ jamanaw ni ɲɔgɔn cɛ jɛɲɔgɔnyaw ma. A ɲini ka teliya ka ** .SWIFT MT192 / . SEPA SCT Recall** ani ka bɛnbaliya jira Nafa sɔrɔbaga Tɔgɔ ni Clipper-substituted cɛ IBAN.
3. A dɔn ni i bɛ Local Clipper Malware walima On-Chain Address Poisoning ɲɛ. Aw bɛ sɛbɛnni gansan dɔ da wuli (Notepad kan Windows walima TextEdit macOS kan), waribɔsɛbɛn ladɛrɛsi dɔnta walima misali sɛrɛkili dɔ kopi kɛ (0x71C...89A), k’a nɔrɔ sɛbɛnni-dosiyɛri kɔnɔ. Ni sɛbɛnni nɔrɔlen bɛ Yɛlɛma ka Kɛ ladɛrɛsi wɛrɛ ye i ye min digi o yɔrɔnin bɛɛ Ctrl+V, aw ka minɛn in bɛ baara kɛ ni Clipper Malware ye; aw bɛ ɔridinatɛri tigɛ ka bɔ Wi-Fi ni Ethernet la o yɔrɔnin bɛɛ. Ni sɛbɛnni nɔrɔlen ma Changé Notepad kɔnɔ, i ye Poisoned Vanity Address dɔ kopi kɛ ka bɔ i ka portefeuille ka kɔsa in na jago tariku lisi kɔnɔ.
4. Aw ka fɛnw falen-falen centralisé off-ramps freeze ani ka Tether (USDT) walima Sɛrɛkili (USDC) smart contract blacklist ɲinini. Ni stablecoins sonyalen don (USDT walima USDC) bilala ka taa waribɔlan dɔ la min baga bɛ a la walima min bɛ kɛ ni clipper ye Ethereum kan, Tron (TRC-20), walima Solana, ka Transaction Hash (TXID) bloki ɲininikɛla dɔ kan ( .Etherscan, . Tronscan, . Solscan) ani ka sariya labatoli kɔrɔtɔlen freeze ticket di Tether ( ) ma.tether.to) walima Sɛrɛkili (circle.com), minnu bɛ ni marako hakilitigi-kontra kilisi ye (AddedBlackList / . freeze) min bɛ se ka nɛnɛ sonya USDT/ .USDC binkannikɛla ka waribɔlan kɔnɔ k’a ɲɛsin a yɛrɛ ma.
5. Aw bɛ nafolo tɔ bɔ PC banakisɛ bɛ min na ni minɛn wɛrɛ ye min saniyalen don. Sabula Clipper Malware (Laplas Clipper, . ClipBanker, . Lumma, . RedLine) bɛ se ka fara ɲɔgɔn kan tuma bɛɛ seereyaw ni kisɛ-kumasen infostealer kɔnɔ min ka bon kosɛbɛ, k’a miiri ko porogaramuw ka waribɔlan bɛɛ (MetaMask, . Phantom, . Exodus) ani tɔgɔlasɛbɛn maralen o ɔridinatɛri kɔnɔ, o bɛ tiɲɛ. Aw kana aw ka kisɛ kumasen walima aw yɛrɛ ka kilisi sɛbɛn masin bananen kɔnɔ.

--- .

Binkanni in sɛgɛsɛgɛli: Sigida Clipper Malware ni On-Chain Address Poisoning¶

Hali n’a y’a sɔrɔ o binkanni fila bɛɛ bɛ kɛ sababu ye k’i ka wari se binkannikɛla dɔ ka waribɔlan ma sanni i ka se ka se i laɲinibaga ka ladɛrɛsi ma, u ka fɛɛrɛbɔcogo tɛ kelen ye fewu. I ka kan k’a dɔn binkanni min kɛra segin 60 fɔlɔ kɔnɔ bawo Local Clipper Malware kɔrɔ ye ko i ka baarakɛminɛnw tiɲɛna, k’a sɔrɔ Address Poisoning bɛ kɛ a bɛɛ lajɛlen na foroba blockchain kan k’a sɔrɔ porogaramu jugu si tɛ i ka minɛn kɔnɔ.

1. Sigida Clipboard Hijacker ("Clipper") Malware bɛ baara kɛ cogo min na¶

A Clipper (Trojan.Clipper, . Cryxos, . ClipBanker, . Laplas) ye kɔkanna baarakɛcogo nɔgɔman ye, Chrome/Firefox navigatɔrɔn jugumanba, walima Trojanized open-source package min bɛ hook dɔ sɛbɛn baarakɛminɛnw ka clipboard API kɔnɔ (AddClipboardFormatListener kan Windows walima NSPasteboard macOS kan). * Real-time Regex pattern matching: Tuma o tuma ni i ye a digi Ctrl+C (Kopi), o porogaramu jugu bɛ sɛrɛkili kopilen sɛgɛsɛgɛ ni Regular Expressions (Regex) ka misaliw ɲini minnu bɛ bɛn Bitcoin ladɛrɛsi dɔ ma (bc1q..., . 1..., . 3...), Ethereum/EVM ladɛrɛsi dɔ (0x o kɔfɛ, taamasiyɛn wɔɔrɔnan 40 bɛ sɔrɔ), Tron TRC-20 ladɛrɛsi (T o kɔfɛ, sɛbɛnnibolo 33 bɛ sɔrɔ), Solana ladɛrɛsi, walima Erɔpu/Angletɛri IBAN (DE89..., . GB29...). * Yɔrɔ caman cili: Milisekɔndi 2 fo 5 kɔnɔ, sani i bolokɔninw ka bɔ Ctrl+C fɛ Ctrl+V, o porogaramu jugu bɛ i ka sistɛmu klipu buffer sɛbɛn ni binkannikɛla ka ladɛrɛsi ye. Baarakɛda minnu bɛ taa ɲɛ i n’a fɔ Laplas Clipper hali ka vanity address on the fly kɛ waati yɛrɛ la ka bɔ kunnafonidilanba dɔ la min jatebɔra ka kɔn, binkannikɛlaw ka ladɛrɛsi miliyɔn caman bɛ min kɔnɔ walasa i ye min kopi kɛ sisan, o ka taamasiyɛn 3 fo 4 fɔlɔw ani taamasiyɛn 3 fo 4 labanw ka bɛn i ye min kopi kɛ sisan.

2. On-Chain Vanity Address Poisoning bɛ baara kɛ cogo min na (Zero Malware) .¶

Address Poisoning binkanni na, i ka ɔridinatɛri, telefɔni ani waribɔlan tɛ tiɲɛ. O nɔ na, blockchain bagabagalikɛlaw bɛ bot otomatikiw baara minnu bɛ foroba bɛɛ kɔlɔsi USDT, . USDC, . ETH, . TRX, ani WBTC jiginni Ethereum, Tron, Arbitrum, BSC ani Solana kan. * The Vanity Prefix/Suffix Generator: Waati min na i bɛ fɛn dɔ ci min bɛ sariya kɔnɔ (hali smart-contract practice test transfer of $10) ka taa a sɔrɔbaga lakika ladɛrɛsi la, misali la: * Adɛrɛsi sɛbɛ: 0x89205A3A3b2A69De6Dbf7f01ED13B2108B2c43e7 * Binkannikɛla bɛ baara kɛ ni GPU kuluw ye walasa ka waribɔlan ladɛrɛsi nkalonma dɔ dilan min ka taamaʃyɛn 5 fɔlɔw (0x89205...) ani taamasiyɛn 5 labanw ( ....c43e7) bɛ kelen ye kɛmɛsarada la ni i sɔrɔbaga lakika ka ladɛrɛsi ye, k’a sɔrɔ cɛmancɛ 30 taamasiyɛnw tɛ kelen ye pewu : * Poisonné Lookalike Adrɛsi: 0x89205f91c48012b3847109ab84910283749c43e7 * Ka i ka jago tariku nɔgɔ (Zero-Value walima Fake Token Spoofing): Sabula ERC-20 ni TRC-20 hakilitigiw ka bɛnkansɛbɛnw (transferFrom) a to mɔgɔ o mɔgɔ ka a bɔ a 0 USDT transfert event ka bɔ i ka portefeuille kɔnɔ ni i ka privé key tɛ (walima ka ci $0.0001 "buguri" walima unicode-spoofed nkalonma dɔ USDТ token), binkannikɛla bɛ jago nkalonma dɔ don i ka waribɔsɛbɛn foroba jago sɛbɛn kɔnɔ walasa u ka ladɛrɛsi min bɛ i n'a fɔ baga bɛ i la, o ka sigi i ka "Jamana kɔsa in na" lisi sanfɛ yɛrɛ. * UI Truncation Trap: Sabula mobili ni navigatɛri waribɔlanw (MetaMask, . Trust Wallet, . Ledger Live, . TronLink, . Etherscan) ka ladɛrɛsi janw tigɛ minnu bɛ ni taamasiyɛn 42 ye ekran kan i n' a fɔ 0x89205...c43e7 walasa ka yɔrɔ mara, ladɛrɛsi lakika ni ladɛrɛsi bagalen fila bɛɛ bɛ i n’a fɔ ɲɛnajɛ la i ka jago tariku kɔnɔ. Dɔgɔkun nata la, n’i taara tiɲɛ ci $50,000 transfert ani lazily copy ladɛrɛsi ka bɔ i yɛrɛ ka "last transaction" kɔnɔ i ka portefeuille tariku kɔnɔ sanni i ka ladɛrɛsi gafe, i bɛ binkannikɛla ka ladɛrɛsi bagalen kopi. * Create2 Smart Contract Pre-Computation: Binkanni ɲɛtaa minnu bɛ kɛ ka nafolo sɔrɔyɔrɔw laɲini, binkannikɛlaw bɛ baara kɛ ni EVM ye CREATE2 opcode ka kɔn ka kɔn ka smart contract ladɛrɛsi miliyɔn caman dilan minnu bɛ sunɔgɔ la ni daɲɛ 6 ye minnu bɛ daminɛ ni taamasiyɛn 6 ye minnu bɛ tali kɛ ɲɔgɔn na (12 matching hex characters total). Ni jatigɛwalekɛla dɔ ye wari ci ladɛrɛsi min bɛ sunɔgɔ la, binkannikɛla bɛ sweeper kontra dɔ bila sen kan o cogo tigitigi la CREATE2 ladɛrɛsi walasa ka nafolo bɔ a yɛrɛma.

--- .

Kɔrɔtɔko baarakɛcogo : ka portefeuille swapped walima IBAN transfert triaging¶

Aw bɛ tugu nin desizɔn jiri in kɔ o yɔrɔnin bɛɛ n’aw y’a ye ko ladɛrɛsi min nɔrɔlen don, o ni aw tun b’a fɛ ka taa yɔrɔ min na, o tɛ bɛn.

flowchart TD
    A["A sɔrɔla ko Crypto Address jugu walima IBAN Pasting kɔfɛ"] --> B{"Yala Jago in tun bɛ bɔ kɛnɛ kan / a cilen don kaban wa?"}
    B -- "Ayi (A minɛna Sani a ka bolonɔ bila)" --> C["Kɔrɔbɔli Clipboard kɔnɔ Notepad kɔnɔ: Adrɛsi lakika kopi ani ka nɔrɔ"]
    B -- "Ɔwɔ (A cilen don kaban)" --> D{"Yala Crypto don Mempool kɔnɔ, Crypto Confirmé, walima Bank IBAN kɔnɔ wa?"}
    C --> E{"Yala sɛbɛnni minnu nɔrɔlen don, olu Changé Notepad kɔnɔ wa?"}
    E -- "Ɔwɔ: Sigida Clipper Malware" --> F["Ɛntɛrinɛti tigɛtigɛ teliya la; Scan Services/Extensions/Baara minnu bɛ kɛ"]
    E -- "Ayi: On-Chain Address Poisoning" --> G["Contact Poisonné (Jɛkulu min bɛ baga) bɔ; Whitelist Address lakika min bɛ Portefeuille de matériel kɔnɔ"]
    D -- "Crypto Hali bi a bɛ Mempool dugu kɔnɔ" --> H["Broadcast Nonce Cancel (EVM +30% Gaz) walima Bitcoin RBF O yɔrɔnin bɛɛ"]
    D -- "Crypto On-Chain min sɛgɛsɛgɛra" --> I["Trace TXID: Filen Kɔrɔtɔko Freeze ni Tether (USDT) / Circle (USDC) / CEX"]
    D -- "Banki IBAN / Baarakɛminɛnw" --> J["Banki weleli nanbarako: Demand SWIFT MT192 / SEPA Recall + Cite Name Mismatch"]

--- .

Clipboard hijacking ni ladɛrɛsi baga fɛnɲɛnamafagalanw sumalen¶

Baara kɛ ni nin tabali in ye walasa k’a dɔn ladɛrɛsi ɲɔgɔn falen-falen kɛra cogo min na ani forensic artifact minnu bɛ i ka sistɛm walima blockchain explorer kan.

--- .

Kɔrɔtɔko walew senfɛ-senfɛ ni nafolo cilen don dɔrɔn ladɛrɛsi jugu la¶

N'i ye "Send" digi walima n'i y'i bolonɔ bila jago la ka sɔrɔ k'a kɔlɔsi ko ladɛrɛsi cɛmancɛ sɛbɛnniw ye Clipper walima Address Poisoner dɔ ta ye, i ka nin wale ninnu kɛ o yɔrɔnin bɛɛ.

1. Ka kriptowari jago dɔ tiɲɛ min ma dafa mempool kɔnɔ (Segin 10 fo 60 fɔlɔ) .¶

Ni blockchain rezow ka ca walima ni i ye gazi/satoshi sara dɔgɔman sigi, i ka jago bɛ se ka sigi hali bi foroba mempool kɔnɔ ka makɔnɔni kɛ ka don bloki dɔ kɔnɔ: * Ethereum, Arbitrum, Polygon, Jigiya, Base, ani BSC kan (EVM Cakɛdaw): 1. Da wuli MetaMask, . Rabby, walima Trust Wallet ani ka Waleya yɔrɔ lajɛ. Ni jago ko Pending, i ka Cancel butɔn digi o yɔrɔnin bɛɛ ka Aggressive / High Gas Fee sugandi. 2. Manual Nonce Overwrite (More Reliable): Aw ye Customize transaction nonce kɛ aw ka waribɔsɛbɛn ka Advanced Settings kɔnɔ. Aw ye aw ka jagokɛcogo lajɛ min bɛ sen na Etherscan walasa k’a Nance nimɔrɔ tigitigi sɔrɔ (misali la, Nonce: 42). O yɔrɔnin bɛɛ la, aw bɛ jago kura ci daminɛ ** .0 ETH ka taa i yɛrɛ ka waribɔ ladɛrɛsi la**, i bolo don a kɔnɔ 42 ka Custom Nonce yɔrɔ la, ani ka Max Priority Fee (Gwei) a dɔgɔyalenba la 30% fo 50% ka ca ka tɛmɛ jagokɛla min sirilen don. Minɛriw/validateurs bɛna i ka higher-fee baara 0 ETH jago fɔlɔ, ka tiɲɛni jugu kɛ ni Nonce 42. * Bitcoin kan (BTC): 1. Bi portefeuilles fanba (Electrum, . Sparrow, . Ledger Live, . BlueWallet) ka Opt-in Replace-By-Fee (BIP-125 RBF) ka kɛɲɛ ni a daminɛ ye. 2. I kininbolo digi bɔli kan min ma dafa i ka waribɔsɛbɛn tariku kɔnɔ ani ka Cancel Transaction ( ) sugandi.Double-Spend to Self) walima Bump Fee / Modify Output, ka sara hakɛ dɔ sigi sen kan min ka bon kosɛbɛ (sat/vB sɛgɛsɛgɛli kɛra ka kɛɲɛ ni mempool.space) walasa minɛnkokɛlaw ka fɛn falen-falen jago dafa ka segin i yɛrɛ ka fɛn caman cili ladɛrɛsi kan.

2. Freezing sonyalen USDT (Tether) walima USDC (Circle) ka tɛmɛn smart contract blacklisting fɛ¶

A tɛ i n’a fɔ Bitcoin walima Ethereum yɛrɛma, Ameriki dɔrɔmɛ stablecoin belebele fila, Tether (USDT) ani Sɛrɛkili (USDC), marako baarabolodalenw bɛ sɔrɔ u kɔnɔ (blacklist, . freeze, . destroyBlackFunds) minnu sɛbɛnna k' u ɲɛsin u ka token smart contracts ma Ethereum kan (ERC-20), Tɔrɔn (TRC-20), Solana, Poligon ani Avalanche. 1. Da wuli Etherscan.io walima Tronscan.org ani ka i ka Transaction Hash (TXID). Aw ye a lajɛ ni sonyalen don USDT walima USDC bɛ a sigilen bɛ hali bi binkannikɛla ka vanity/clipper wallet kɔnɔ walima cɛmancɛ staging waribɔ. Adrɛsi baga bɛ to ka sonya USDT ladɛrɛsi vaniti kɔnɔ lɛrɛ walima tile caman kɔnɔ ka sɔrɔ k’a ɲɔgɔn falen-falen ni fɛnw falenfalenni ye (DEXs) walima cross-chain bridges (bonda minnu bɛ ɲɔgɔn cɛ. 2. Aw bɛ teliya ka kɔrɔtɔko kunnafoni di FBI IC3 (ic3.gov) ani sigida sariyatigiw, ani ka kuma o waati kelen na Tether Compliance / Law Enforcement Support (tether.to/en/contact-us) walima Sɛrɛkili sariya labatoli ɲininiw ni tigitigi: * Jatigɛwalekɛla ka portefeuille ladɛrɛsi * Binkannikɛla ka taa yɔrɔ portefeuille ladɛrɛsi min bɛ sisan USDT/ .USDC balansi (balance) la * Jagokɛlaw ka Hash (TXID) ani waati taamasiyɛn 3. Aw ye sonyali in fɔ waati kelen na ka ɲɛsin blockchain hakilijagabɔ ko kɛlenw jaabi rezow ma i n’a fɔ Chainalysis, TRM Labs (Chainabuse.com), SƐBƐN 911 (Security Alliance kɔrɔtɔko Telegram bot @seal_911_bot for acute crypto hacks), ani sariya labatoli tabali minnu bɛ fɛnw falen-falen cɛmancɛ la (Binance, . Coinbase, . OKX, . Kraken, . Bybit, . FixedFloat, . ChangeNOW) ni binkannikɛla ye wari bila fɛnw falen-falen ladɛrɛsi dɔ kɔnɔ.

3. Ka hakili jigin Clipper-swapped banki fili walima IBAN transfert (yɛrɛlabɔli).¶

Ni Clipper malware ye jagokɛlaw walima mɔgɔ yɛrɛ ka banki baarakɛlaw laɲini, a b’a kɔlɔsi ko u kopi kɛra IBAN sɛrɛkiliw (i n’a fɔ ka an kopi kɛ IBAN ka bɔ feerekɛla dɔ ka PDF fatura la Adobe Reader kɔnɔ ani k’a nɔrɔ ɛntɛrinɛti banki dakun dɔ la) ani ka swaps the IBAN ni wari-mule jatebɔsɛbɛn ye k’a sɔrɔ a ma Nafa sɔrɔbaga tɔgɔ to a ma maga. * Ka wele bila Sɛgɛsɛgɛli kɛ Saratigi la (VoP / . Confirmation of Payee) ani Tɔgɔ-Bɛnkan sariyaw: Aw bɛ aw ka banki ka telefɔni nanbaratɔn wele joona. A ɲɛfɔ ko Clipper Malware ye fɛn nɔrɔlenw Changé IBAN nimɔrɔ min bɛ i ka ɔridinatɛri kan ani ko Nafa sɔrɔbaga ka jatebɔsɛbɛn tɔgɔ min bɛ wari sarali yamaruya kan, o tɛ bɛn sariya sira tigi ma min bɛ bila a nɔ na IBAN. * Erɔpu tɔnba ka sariyasen kɔnɔ min bɛ wari sara teliya la (EU Regulation 2024/886) ani Angletɛri ka Saratigi ka dantigɛli (CoP) karamɔgɔya: Sarako baarakɛlaw ka kan k’a sɛgɛsɛgɛ ko... IBAN ani Nafa sɔrɔbaga Tɔgɔ bɛ bɛn sani a ka faga, wa a ka kan ka teliya ka ** ci .SEPA Credit Transfer (SCT) Recall (camt.056)** ka ɲɛsin Namara ma bankiw ni ɲɔgɔn cɛ sɛgɛsɛgɛli finɛtiri kɔnɔ. * EIP-55 Checksum ni Mod-97 IBAN daliluw lakanani: Sɛbɛnni tigitigi IBAN o tun bɛ i ka PDF fatura fɔlɔ kɔnɔ versus the IBAN min bɛ ci i ka ɛntɛrinɛti banki jatebɔ sɛbɛn kɔnɔ. Sabula IBAN sɛrɛw kɔnɔ, ISO 7064 Mod-97-10 checksum bɛ sɔrɔ nimɔrɔ 2 ye jamana kode kɔfɛ dɔrɔn (misali la, GB29 walima DE89), hadamaden ka sɛbɛnni fili dɔ bɛ se ka dɛsɛ banki dakun ka Mod-97 jatebɔ tiɲɛni na o yɔrɔnin bɛɛ. K’a jira ko o ye kojugu ye IBAN had a mathematically valid Mod-97 check digit b’a jira i ka banki ka nanbara sɛgɛsɛgɛlikɛlaw la ko Clipper otomatiki dɔ ye jatebɔsɛbɛn bɛɛ bila a nɔ na sanni baarakɛla dɔ ka fili kɛ keystroke la.

--- .

Local Clipper Malware (Windows, macOS, ani Browsers) ɲinini ani u ban .¶

Ni i ka Notepad sɛgɛsɛgɛli y’a jira ko i ka clipboard bɛ ka portefeuille ladɛrɛsi kopilenw sɛmɛntiya kosɛbɛ walima IBAN nimɔrɔw, i ka masin bɛ baara kɛ ni Clipper payload baarakɛta ye. Aw bɛ nin fɛɛrɛ ninnu labato ɛntɛrinɛti kɔkan walasa k’a faranfasi ani k’a bɔ.

Fase 1: A lajɛ ni Clipper bɛ balo i ka Web Browser Extensions kɔnɔ¶

Sani i ka sɛgɛsɛgɛli kɛ sistɛmu dosiyew kɔnɔ, i k’a dɔn ni navigatɔrɔn ka farankan jugu dɔ de bɛ o ko ɲɛnabɔ: 1. Da wuli Notepad.exe (Windows) walima TextEdit (macOS) n’i ka ɛntɛrinɛti-navigatɛri ye a datugulen don pewu (a sɛgɛsɛgɛ Task Manager fɛ Ctrl+Shift+Esc ko kɔkanna tɛ yen chrome.exe walima msedge.exe taabolo bɛ sen na). 2. Ethereum ladɛrɛsi nkalonma dɔ sɛbɛn (0x1111222233334444555566667777888899990000) Notepad kɔnɔ, a jira, a digi Ctrl+C, ka taa layini kura dɔ la, ka digi Ctrl+V. 3. Ni ladɛrɛsi TƐ Changé Notepad kɔnɔ ni navigatɛri datugulen don, nka A BƐ Changé ni i bɛ kopi kɛ ka bɔ Chrome/Edge/Brave kɔnɔ: I ye navigatɔrɔn extension jugu dɔ sɔrɔ (Malicious Clipper Extension). * I ka navigatɛri da wuli, i ka sɛbɛnni kɛ chrome://extensions (walima edge://extensions / . about:addons), ani ka farankan bɛɛ bɔ yen min ma dɔn, kɛrɛnkɛrɛnnenya la, piblisite balilan nkalonmaw, PDF bɔgɔlanw, dibi-cogo-yɔrɔ-ko-minɛnw, kumakan bonyalanw, walima nkalontigɛlaw Ledger/ .Uniswap/ .MetaMask dɛmɛbaga ka farankanw. * Reset navigateur sync at chrome.google.com/sync o la Google tɛ o fɛn jugu in bila a yɛrɛma n’i seginna ka don a kɔnɔ.

Dakun 2nan : OS-nivo Clipper baarakɛcogo dɔnni ani k’u faga Safe Mode kɔnɔ¶

Ni ladɛrɛsi bɛ Changé hali kɔnɔna na Notepad ni navigatɔrɔw bɛɛ datugulen don, i bɛ ni Clipper (ClipBanker, . Laplas, . Phemedrone, . RedLine).

Windows 10 ani Windows 11 kan¶

1. Aw bɛ Wi-Fi bɔ ani ka Etɛrinɛti fiyɛli bɔ o yɔrɔnin bɛɛ.
2. Da Baara ɲɛmɔgɔ (Ctrl + Shift + Esc), Startup Apps tab digi, ka porogaramu o porogaramu dɔnbali bali (Clippers bɛ to k’u yɛrɛ kɛ i n’a fɔ Realtek HD Audio Helper, . Windows Updater, . Java Update Scheduler, walima OneDrive Sync Host min bɛ sɔrɔ kɔnɔ AppData\Roaming\ sanni ka kɛ C:\Windows\System32\).
3. Da Baara bolodacogo (Win + R -> taskschd.msc). Aw bɛ baara bɛɛ sɛgɛsɛgɛ Baara bolodacogo gafemarayɔrɔ kɔnɔ. Clippers bɛ to ka to kosɛbɛ ni Scheduled Task dɔ dabɔli ye min bɛ baara kɛ miniti 1 o miniti 1 walima baarakɛla dontɔ, ka PowerShell cikan dogolen dɔ wele, .vbs sɛbɛnnibolo, . AutoIt3.exe sɛbɛnnibolo, walima .exe maralen bɛ kɔnɔ:
4. C:\Users\<Username>\AppData\Roaming\
5. C:\Users\<Username>\AppData\Local\Temp\
6. C:\ProgramData\
7. A digi Win + R, suguya regedit, ani ka Run keys fɔlɔ naani lajɛ Clippers y’u tɔgɔ sɛbɛn yɔrɔ minnu na walasa ka daminɛ daminɛ na :
8. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
9. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
10. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
11. HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run

MacOS kan (NSPasteboard Sonyalikɛlaw: Atomic Stealer AMOS, . Poseidon) .¶

1. Aw bɛ Wi-Fi ni ɲɔgɔn cɛ jɛɲɔgɔnya tigɛ.
2. Activity Monitor da wuli ka taabolo bolonɔbilalenw ɲini walima Python/osascript sɛbɛnniw kɔlɔsili dogolenw NSPasteboard.
3. A digi Cmd + Shift + G in Finder ani ka sɛgɛsɛgɛli kɛ /Library/LaunchAgents/, . /Library/LaunchDaemons/, ani /Users/<YourUsername>/Library/LaunchAgents/ ka ɲɛsin namaratɔw ma .plist persistence files (dakunw) dosiyew.

--- .

Hardware wallet defense: cogo min na Clipper ni Poisoning binkanniw tɛ se ka kɛ¶

Hali n’i ka ɔridinatɛri banana ni Clipper porogaramu juguba ye min ka bon kosɛbɛ dugukolo kan, walima n’i ka jago tariku falen don ni ladɛrɛsi nafama kɛmɛ caman ye minnu baga bɛ u la, binkanni fila si tɛ se k’i ka wari sonya n’i tugura Hardware Wallet gɛlɛn dɔ kɔ (Ledger, . Trezor, . Keystone, . Coldcard, . GridPlus) farikolola ekran sɛgɛsɛgɛli protocol : .

1. "Cɛmancɛ-8 + Daminɛ-4 + laban-4" Karamɔgɔya sɛgɛsɛgɛli sariya: Kana i ka ɔridinatɛri kɔrɔsibaga lajɛ abada walasa ka ladɛrɛsi dɔ sɛgɛsɛgɛ, bawo navigatɛri jugu dɔ bɛ se ka ladɛrɛsi lakika jira i ka ɔridinatɛri ɲɛ kan k’a sɔrɔ a bɛ binkannikɛla ka ladɛrɛsi ci i ka waribɔsɛbɛn ma kɔfɛ. O nɔ na, i ka **i ka fɛnɲɛnamafagalanw ka waribɔlan yɔrɔ farikoloma OLED/E-Ink lajɛ k’a suma ni kumaɲɔgɔnya sira filanan ye, min yɛrɛmahɔrɔnyalen don (i n’a fɔ a sɔrɔbaga ka QR kode foto min bɛ i ka telefɔni seleke naani kan walima cɛmancɛ sɛbɛnniw kan kalanni sɛgɛsɛgɛlen):

0x 8920 [5A3A3b2A69De6Dbf7f01ED13B2108B] 2c43e7
   ====              ==========            ======
  Start-4          Verify Middle-10        End-6

1. I kana ladɛrɛsi dɔ kopi kɛ abada i ka "Recent Transactions" walima Block Explorer tariku kɔnɔ: Aw ye aw ka waribɔsɛbɛn ka jagokɛta tariku furakɛ (Activity tab min bɛ MetaMask, Ledger Live, Trust Wallet, walima Etherscan kɔnɔ) i n’a fɔ foroba sɛbɛnni minnu tɛ dannaya sɔrɔ. Mɔgɔ o mɔgɔ bɛ dugukolo kan, o bɛ se ka jirisun nkalonmaw pikiri i ka foroba jago tariku kɔnɔ. O nɔ na:
2. Aw bɛ ɲɔgɔndan kelen-kelen bɛɛ mara min bɛ segin-ka-bɔ, wari bilayɔrɔ ladɛrɛsi, ani nɛnɛ marayɔrɔ waribɔlan kɔnɔ aw ka waribɔlan faso kɔnɔ Address Book / Whitelist Contacts (Settings -> Contacts in MetaMask/Rabby) ni hadamaden ka taamasiyɛn jɛlen ye ("My Coinbase USDC Deposit").
3. Ni ladɛrɛsi dɔ marala i ka ladɛrɛsi gafe kɔnɔ, bi waribɔlanw bɛ bila a tigɛlenw nɔ na 0x1234...5678 hex string ni contact ka tɔgɔ maralen badge ye interface bɛɛ kɔnɔ. Ni jago dɔ bɛ i ka tariku kɔnɔ min ye hex taamasiyɛn raw jira i ka contact badge maralen nɔ na, i b’a dɔn o yɔrɔnin bɛɛ la ko o ye imposter ladɛrɛsi baga ye.
4. Aw bɛ wuli ka taa waribɔlan kliyan dɔ la min sinsinnen bɛ lakana kan (Rabby, . Frame, walima Ledger Clear Signing) ni Poyi Detection: . Portefeuilles i n’a fɔ Rabby Wallet ani MetaMask Blockaid security alerts bɛ taamasiyɛn kɛ u yɛrɛma siɲɛ fɔlɔ fɛnw cili ladɛrɛsi la min ma deli ka wari sɔrɔ i fɛ fɔlɔ, olu b’i lasɔmi ni ladɛrɛsi dɔ bɛ mɔgɔ dɔ ladege i ɲɛ na (Similarity Warning), ani ka dogo 0-value spoofed token transfers ka bɔ i ka baara kunba feed la.

--- .

Ko kɛlen kɔfɛ furakɛli sɛgɛsɛgɛli sɛbɛn¶

• Ka kripto nafolo tɔw labɔ ka taa fɛnɲɛnamafagalanw ka waribɔ kisɛ kura yɛrɛ la: Ni aw bɛ baara kɛ ni ɛntɛrinɛti saniyalen ye walima ɔridinatɛri min tɛ fɛn tiɲɛ, ka daɲɛ 24 kisɛ kumasen kura dɔ labɛn fɛnɲɛnamafagalanw ka waribɔlan kan ani ka tokenw, NFTw, ani gazi nafolomafɛnw tɔw bɛɛ bɔ porogaramuw ka waribɔlan suguya bɛɛ la (MetaMask, . Phantom, . Trust Wallet, . Exodus) min tun bɛ Clipper banakisɛ bɛ ɔridinatɛri min na.
• Ka ERC-20 / TRC-20 token sɔnniw bɔ yen minnu bɛ baara la: Baara kɛ ni u ye revoke.cash (ka bɔ minɛn saniyalen dɔ la) walasa ka token musaka danmadɔw bɛɛ bɔ yen minnu bɛ tali kɛ waribɔlan funtenimanw na minnu bɛ tiɲɛni kɛ.
• Aw bɛ OS saniyalen seginni dafalen kɛ USB fɛ ni Local Clipper Malware tiɲɛna: Aw ye aw yɛrɛ ka sɛbɛnw dɔrɔn de labɛn ani ka disiki yɔrɔw bɛɛ ko ni Windows/macOS USB installer saniyalen ye min dabɔra ɔridinatɛri danfaralen dɔ kan (aw ye an ka navigatɛri jugumanw ni clipboard hijackers bɔli gafe).
• Aw ye navigatɔrɔn ka tɔgɔlasɛbɛnw bɛɛ wuli minnu maralen bɛ ani ka sessions actives bɔ yen: Aw bɛ tɔgɔlasɛbɛnw Changer email, banking, ani centralized exchanges (Coinbase, . Binance, . Kraken), ani ka i bolonɔ bila kalansenw bɛɛ la minnu bɛ kɛ.
• Ka sariya labatoli ni blockchain kunnafonidilaw ka kunnafoniw ofisiyali di:
• Amerika: Aw ye FBI IC3 (ic3.gov) rapɔɔri min kɔnɔ Transaction Hash tigitigi bɛ sɔrɔ (TXID), i ka waribɔ ladɛrɛsi, ani binkannikɛla ka Clipper/Poisoned waribɔ ladɛrɛsi.
• Royaume-Uni: Laseli Action Fraud (actionfraud.police.uk).
• Erɔpu tɔnba / Duniya: Laseli Erɔpu jamana ka sibɛri juguya dakunw fɛ, Chainabuse (chainabuse.com), ani Etherscan / Tronscan "Report/Flag Address" o la binkannikɛla ka ladɛrɛsi bɛ taamasiyɛn kɛ foroba la ni bilen ye Fake_Phishing / Address Poisoning lasɔmini pankarti min bɛ di mɔgɔ nataw ma minnu bɛna tɔɔrɔ.

--- .

Ɲininkali minnu bɛ kɛ tuma caman na¶

Cogo di nanbarakɛla dɔ ye Etherscan walima Tronscan jira a $0 USDT transfert min bɛ bɔ n ka portefeuille kɔnɔ (From: My Wallet -> To: Scammer Wallet) n' u tɛ ne ka privé key walima seed phrase sɔrɔ ?¶

Nin ye quirk ye cogo min na standard **ERC-20 ani TRC-20 token smart contracts** (`transferFrom` baarakɛcogo) bɛ sɛbɛn Ethereum, Tron ani BSC kan. Ni mɔgɔ sabanan ye wele kɛ `transferFrom(Sender, Recipient, Amount)`, smart contract bɛ a lajɛ ni welelikɛla ka bolomafara yamaruyalen dɔ bɛ a bolo (`approve`) o kama `Amount`. Parce que i ka default allowance ka dunan ye `0`, weleli `transferFrom(Your_Wallet, Scammer_Vanity_Wallet, 0)` bɛ ɲini ka allowance dɔ sɔrɔ `0 <= 0`, min bɛ jateminɛ kɛ ka kɛ **Tiɲɛ** ye ka ɲɛ sɔrɔ k'a sɔrɔ i mago tɛ i bolonɔbila walima i yɛrɛ ka kilisi la. I ka waribɔsɛbɛn ma tigɛ abada; binkannikɛla ye santimɛtɛrɛ damadɔ dɔrɔn de sara gazi la walasa USDT ka bɛnkansɛbɛn ka kɛ foroba ye `Transfer` ko kɛlenw jatebɔsɛbɛn min bɛ i ka ladɛrɛsi jira `From` koloma walasa u ɲɔgɔnna ladɛrɛsi ka bɔ i ka waribɔsɛbɛn bɔli tariku kɔnɔ.

Mun na nanbarakɛla ye fake transaction ci n ma 50,000 USDT o yɔrɔnin bɛɛ n ye ci bila a $10 test transaction ka n terikɛ?¶

Kripto baarakɛlaw minnu bɛ se kosɛbɛ, olu ka teli ka fitinin dɔ ci `$10` jagokɛcogo kɔrɔbɔ fɔlɔ, k'a sɛgɛsɛgɛ k'u terikɛ y'a sɔrɔ, o kɔfɛ, u bɛ don u ka waribɔsɛbɛn kɔnɔ "Baara kɛlen kɔsa in na" yɔrɔ la walasa ka taa yɔrɔ ladɛrɛsi kopi kɛ kunba ye `$50,000` transfert (yɛrɛlabɔli). Address poisoning bots kɛrɛnkɛrɛnnenya la kɔlɔsili kɛ misɛnninw na `$1 to $100` fɛnw jiginni. Seginkanni 10 kɔnɔ i ka `$10` test transfer confirming on-chain, binkannikɛla ka otomatiki bot bɛ nafantan ladɛrɛsi dɔ dilan min bɛ bɛn i terikɛ ka ladɛrɛsi taamasiyɛn 5 fɔlɔ ni laban ma ani ka token cili nkalonma dɔ bɔ i ka waribɔlan na ka taa u ka nafantan ladɛrɛsi la walasa **u ka ladɛrɛsi bagalen ka sigi jirisun kelen sanfɛ i ka Kɔsa in na baara lisi kɔnɔ ka tɛmɛ i yɛrɛ ta kan `$10` sɛgɛsɛgɛli jiginni**.

Yala Clipper malware bɛ se ka iPhone (iOS) walima Android telefɔni, walima a bɛ nɔ bila Windows ni Mac ɔridinatɛriw dɔrɔn de la wa?¶

Hali ni klasiki kɔkanna-klipboard lamɛnbagaw ka ca Windows ni macOS kan, telefɔni selilɛriw fana bɛ laɲini. K’a daminɛ **iOS 14+** ani **Android 12+** la, baarakɛminɛn bɛ tositi pankarti yelen dɔ jira ekran sanfɛ (`"App pasted from Chrome"`) tuma o tuma ni porogaramu dɔ y’i ka jatebɔsɛbɛn kalan, ani ka kɔkanna porogaramuw bali ka sɛbɛnfura kalan walima k’a sɛbɛn u makuntɔ k’a sɔrɔ u ma ɲɛfɛla sinsin. Nka, portefeuille mobile nkalontigɛlenw (`fake Ledger Live`, . `fake Trust Wallet`, walima Android min bɛ kɛ kɛrɛfɛ `.apk` trojanw bɛ i n’a fɔ `SharkBot` ani `Xenomorph`) ani mobili klaviyeti juguw bɛ se ka hali bi intercept ani swap pasted `IBAN` ani kripto ladɛrɛsiw k’a sɔrɔ appli da b’a la ɛkran kan.

Ni n ye ci bila bala la $25,000 in. kɔnɔ USDT ka taa ladɛrɛsi baga dɔ la, yala sababu bɛ yen binkannikɛla bɛna kumaɲɔgɔnya kɛ "white-hat bounty" seginni kan ni n ye cikan ci u ma cakɛda kan (IDM) ?¶

Ko minnu man teli kosɛbɛ, minnu bɛ fɔ kosɛbɛ, minnu bɛ tali kɛ dɔrɔmɛ miliyɔn caman na, nafolo minnu bɛ se ka tugu ɲɔgɔn kɔ, sariya labatoli degun faralen ɲɔgɔn kan ni cakɛda kan donna-donna cikan ye (`UTF-8 hex message` cilen ETH jago misɛnnin dɔ kɔnɔ binkannikɛla ka ladɛrɛsi la min bɛ kɛmɛsarada la 10 fo 20 di walima ka lasɔmini kɛ Tether freezes ni CEX KYC exposure surunyalen na) o kɛra sababu ye ka segin yɔrɔ dɔw sɔrɔ. Nka, **aw kana "crypto recovery hacker" mɔgɔ sabanan si sara abada walima ka wari sara fɔlɔ**, ani ka **Tether ( ) sɔrɔli bila jɔyɔrɔ fɔlɔ la.`USDT`) walima Sɛrɛkili (`USDC`) ka blacklist ani ka smart contract balansi freeze fɔlɔ**. Siɲɛ kelen Tether ye sonyalenw freeze `USDT` binkannikɛla ka ladɛrɛsi kɔnɔ, binkannikɛla tɛ se ka o tokenw musaka walima k’u lamaga abada, wa Tether bɛ se ka tokenw jenilenw jeni ka bɔ kokura (`re-mint`) u bɛ segin ka taa jatigɛwalekɛla sɛgɛsɛgɛlen ma ni sariya labatoli walima kiritigɛso ka yamaruya bɛnnen sɔrɔla.

--- .

Gafe minnu bɛ tali kɛ o ko la¶

• Clipper malware ani vanity address baga bɛ kripto ni banki IBAN ka fɛnw bilali la
• Navigatɛri jugumanw, clipboard hijackers, ani adware bɔli
• Cryptocurrency portefeuille drain ani kisɛ kumasen bɛnkan
• CAPTCHA nkalonma ClickFix PowerShell Win+R klipbɔri porogaramu jugu ani Lumma Infostealer ɲɛnabɔli
• Jɛkulu ka jagokɛlaw ka imɛri bɛnkan (BEC) ani filiw hakilijigin
• Kɔrɔtɔko nimɔrɔw ka kɛɲɛ ni jamana ye

--- .

Sosow ani ɲɛmɔgɔyaso ka bilasiralikan¶

• Fɛdɛrali ka sɛgɛsɛgɛli biro (FBI) Ɛntɛrinɛti kan kojugubakɛlaw ka ɲininkalikɛyɔrɔ (IC3) (Amerika): Foroba baarakɛlaw ka laseliw Cryptocurrency Vanity Address Poisoning ani Infostealer/Clipper Malware kan.
• Tether Operations Limited (tether.to) & Sɛrɛkili Ɛntɛrinɛti Nafolo (circle.com): Sariya labatoli Freeze, Blacklist (AddedBlackList), ani Nafolo sɔrɔcogo minnu bɛ kɛ sonyalenw na USDT ani USDC.
• Erɔpu jamanaw ka wariko tɔnba (EPC) & Erɔpu tɔnba (Regulation (EU) 2024/886): SEPA ka juruw jiginni (SCT) Hakililajigin taabolo nanbarako ni sarala sɛgɛsɛgɛli (VoP / . IBAN-Tɔgɔ Sɛgɛsɛgɛli) Sariyaw.
• Jamana ka Sibɛri Lakanali yɔrɔ (NCSC) (Royaume-Uni): Ka porogaramu juguw nɔgɔya, ka Browser Extension Compromise, ani Sarali Lasegin nanbara.
• MITRE ATT&CK® Kalanbolo: Fɛɛrɛ T1115 (Clipboard Donanw lajɛli ni u kɛcogo).