Wahi a ka ʻona a me ka Clipboard Hijacker Malware: Hoʻopau i ka Crypto Hoʻololi ʻia a me nā Hoʻololi Wire¶

Hoʻomaopopo i nā manawa ma hope o ke kaomi ʻana i ka "Send" ma kahi hoʻololi cryptocurrency a i ʻole uea panakō ʻo ka helu wahi e hele ai ma ka ʻaoʻao ʻaʻole ** ʻo ka ʻeke a i ʻole IBAN āu i manaʻo ai e uku, ʻoiai ʻo ka 4 a i ka 6 mau huaʻōlelo a me nā 4 a 6 hope loa o ka helu ke nānā like (0x71C9...89A4), 'o ia ho'i, ua pa'i 'ia 'oe e kekahi On-Chain Vanity Address Poisoning Attack a i 'ole Clipboard Hijacker ("Clipper") Malware. ʻAʻole like a cryptocurrency wallet drain a i ʻole ka huaʻōlelo huaʻōlelo kahi e ʻaihue ai ka mea hoʻouka i kāu mau huaʻōlelo hoʻihoʻi 12-huaʻōlelo, ʻaʻole pono ka hoʻopiʻi ʻana a me ka clipper malware i ka mea hoʻouka e ʻike i kāu mau kī pilikino. Akā, hoʻohana nā hoʻouka ʻelua i ka hana maʻamau o ke kanaka o ke kope a hoʻopili ʻana i nā kaula lōʻihi (42-character Ethereum/EVM addresses, 34-to-62-character Bitcoin/Solana/Tron addresses, a i ʻole 15-to-34-character international IBAN bank account numbers) a nānā wale i nā huaʻōlelo mua ʻehā a me ʻehā hope. Inā ʻike ʻia ka helu wahi i hoʻololi ʻia i loko o kāu polokalamu kele pūnaewele a i ʻole ka pākaukau i ka millisecond pololei āu i kaomi ai Ctrl+V (Cmd+V), loaʻa i kāu kamepiula a i ʻole kelepona kahi trojan hoʻopaʻa ʻana i ka clipboard a i ʻole ka hoʻonui ʻia ʻana o ka polokalamu kele pūnaewele; e nīnau i kā mākou alakaʻi ma nā hoʻonui polokalamu ʻino, nā hijackers clipboard, a me ka wehe ʻana i nā mea hoʻolaha. Inā he uea panakō kūloko a i ʻole ka honua ka hoʻololi i hoʻololi ʻia (SWIFT / SEPA / Fedwire / Faster Payments), e hoʻokō koke i nā ʻanuʻu hoʻomanaʻo i loko ka leka uila ʻoihana hui (BEC) a me ka hoʻomanaʻo hoʻopunipuni uea. Inā ke alo nei ʻoe i ka hoʻoweliweli a i ʻole ka hoʻoweliweli koke ʻana i ke ola, e kelepona i kāu helu ulia pōpilikia kūloko (911 ma ʻAmelika Hui Pū ʻIa a me Kanada, 112 ma waena o ka European Union, 999 ma United Kingdom) a i ʻole e nānā i kā mākou papa kuhikuhi o ka honua helu pilikia.

E hana i kēia i kēia manawa¶

1. I loko o 10 kekona, holo i ka "Notepad Copy-Paste Test" e hoʻoholo ai inā ua loaʻa kāu kamepiula/kelepona i ka maʻi ʻo Clipper Malware A i ʻole inā ua kope hewa ʻoe i kahi Address Poisoned mai kāu mōʻaukala kālepa:
2. E wehe i kahi hoʻoponopono kikokikona maʻamau (Notepad, TextEdit, a i ʻole kāu pahu helu mākaʻikaʻi pūnaewele), e kikokiko a kope paha i kahi helu ʻeke kālā maoli (0x71C95911E9a5D330f4D621842EC243EE1343292e), a kaomi Ctrl+V (Cmd+V).
3. Hui A (Hoʻololi ke kaula i hoʻopili ʻia ma waena Ctrl+C a Ctrl+V): Ua maʻi ikaika ʻia kāu hāmeʻa me Clipboard Hijacker ("Clipper") Malware (a i ʻole he Windows/macOS background hiki ke hoʻokō ʻia a i ʻole ka hoʻonui ʻia ʻana o Chrome/Brave/Edge hoʻomāinoino) e keakea ʻana i ka ʻōnaehana papa clipboard API (AddClipboardFormatListener / NSPasteboard) a hoʻololi i kekahi kaula e pili ana i kahi regex no Bitcoin, Ethereum, Solana, Tron (USDT), a i ʻole IBAN me ka helu wahi o ka mea hoʻouka kaua ma lalo o 5 milliseconds. Hoʻokaʻawale koke i kēlā kamepiula mai ka pūnaewele a mai kau inoa i nā hana hou aʻe ma laila.
4. Hui B (ʻAʻole e loli ke kaula i hoʻopaʻa ʻia ke kope ʻoe i ka helu wahi maoli, no ka mea, ua kope hewa ʻoe i ka helu helu hewa mai ka papa inoa "Recent Transactions" o kāu ʻeke a i ʻole Etherscan/Tronscan): Ua loaʻa ʻoe i kahi On-Chain Vanity Address Poisoning Scam, kahi i nānā aku ai kahi bot i kāu hoʻololi ʻana o ka lehulehu, ua hana ʻia kahi ʻano like me ka wakallet e hoʻomaka ana me ka ʻano like ʻole "vanity" ka mea hookipa, a hoouna aku i $0.00 (a i ʻole $0.00001 lepo) i kāu ʻeke kālā no laila ua noho ko lākou ʻano helu wahi ma ka piko loa o ka mōʻaukala kālepa o kāu pēke e kali ana iā ʻoe e kope iā ia. ** ʻAʻole hack kāu kamepiula a me nā kī pilikino; ʻO kāu ʻōlelo huaʻōlelo ʻeke kālā e palekana.**
5. Inā "Ke kali nei" kāu kālepa cryptocurrency i ka mempool (Unconfirmed), hoʻolaha i kahi Replace-By-Fee (RBF) / Hoʻopau koke i ka hana hoʻopau like ʻole:
6. Ma Ethereum, Arbitrum, Optimism, Polygon, Base, a i ʻole BSC (MetaMask, Rabby, Ledger Live, Coinbase Wallet): Inā ʻaʻole i hoʻokomo ʻia ka hana i loko o kahi poloka, e kaomi koke i ka "Cancel" a i ʻole hiki iā Custom Nonce i kāu hoʻonohonoho ʻeke kālā a hoʻouna 0 ETH i kāu helu peke kālā me ka hoʻohana ʻana i ka mea like Nonce helu me kahi 50% kiʻekiʻe aʻe ka uku kinoea (Max Priority Fee) e hoʻopaʻa i ka hana ʻawaʻawa ma mua o ka hōʻoia ʻana o nā mea hōʻoia.
7. Ma ka Bitcoin (Electrum, Sparrow, BlueWallet, Ledger): E kaomi ʻākau i ka hana i hōʻoia ʻole ʻia a koho i ka Cancel (Double-Spend with RBF) a i ʻole Child-Pays-For-Parent (CPFP) ka hoʻihoʻi ʻana i ke kālā i kāu helu wahi hoʻololi me ka uku uku sat/vB kiʻekiʻe.
8. ** Ina oe i hoouna mai USDT (Tether) a i ʻole USDC (Circle) i kahi helu wahi i hoʻopaʻa ʻia a i ʻole ka ʻokiʻoki ʻia, e waiho i kahi noi hoʻokuʻu koke ʻana o ka mea hoʻopuka pilikia (Blacklist / Freeze)**:
9. ʻAʻole like me Bitcoin maoli a i ʻole ETH, nā ʻaelike akamai no USDT (Tether) ma Ethereum, Tron (TRC-20), Solana, a me Avalanche a me USDC (Circle) loaʻa i kahi hoʻokele i kūkulu ʻia addBlackList() / blacklist() hana e hiki ai ke hoʻokuʻu i nā hōʻailona ʻaihue i loko pono o ka ʻeke kālā o ka mea hoʻouka kaua ma mua o ke alahaka ʻana o ka mea hoʻouka a i ʻole ke kālā ʻana iā lākou ma o kahi hoʻololi.
10. E mālama koke i ka Transaction Hash (TxID), ka Attacker's Destination Address, a me kāu Sending Address, e waiho i kahi hōʻike pūnaewele me FBI IC3 (ic3.gov) a i ʻole nā mākaʻi pūnaewele puni honua, e hoʻouna i ka hanana ma Chainabuse (chainabuse.com), a hoʻouna i kahi tikiki hoʻokuʻu koke iā Tether (tether.to/en/contact-us -> Noi Kānāwai / Law Enforcement Freeze Noi) a i ʻole ** Poʻai (circle.com)** ʻoiai e nānā ana i nā kālā ma Etherscan/Tronscan/Arkham e makaala i kekahi hoʻololi kikowaena (Binance, Coinbase, Kraken, OKX, Bybit, HTX) i ka manawa e waiho ai ka mea hoʻouka i ke kālā.
11. Inā he Bank Wire ka hoʻololi i hoʻololi ʻia (IBAN / SWIFT / ACH / Faster Payments i hoʻololi ʻia e ka waihona kālā clipper malware), e kelepona i ka Wire Fraud Recall Desk o kāu panakō i loko o nā minuke 30 mua:
12. Noi koke SWIFT MT192 / MT199 (pacs.004) Hoʻopau a hoʻomanaʻo no ka hoʻopunipuni, e noi i kāu panakō e hoʻouna i kahi leka hoʻopaʻa paʻa i ka panakō i ka panakō i ke keʻena hoʻokō o ka panakō, a hōʻike i nā mea i hoʻololi ʻia. IBAN.
13. E hoʻomaʻemaʻe iā Clipper Malware mai kāu polokalamu kele pūnaewele a me ka ʻōnaehana hana ma mua o ke kope ʻana i kahi kaula ʻē aʻe:
14. Wehe chrome://extensions (a i ʻole edge://extensions, brave://extensions, about:addons) a wehe koke i kēlā me kēia hoʻonui i ʻike ʻole ʻia.
15. Ma Windows, wehe i ka Task Manager / Microsoft Sysinternals Autoruns a nānā i nā hana i hoʻonohonoho ʻia, HKCU\Software\Microsoft\Windows\CurrentVersion\Run, a %APPDATA% / %LOCALAPPDATA%\Temp no ka poʻe hoʻokō ʻino e hoʻolohe ana i ka clipboard.

lāʻau hoʻoholo: Address Poisoning vs. Clipper Malware hōʻailona a pane¶

E hoʻohana i kēia kaʻahele no ka hoʻoholo ʻana i ka vector hoʻouka i hoʻololi i kāu helu wahi e hele ai a me nā hana e hiki ai ke mālama i kāu kālā a i ʻole kāu hāmeʻa:

flowchart TD
    Incident["Hoʻouna ʻia (a ʻaneʻane e hoʻouna ʻia) Crypto a i ʻole ka hoʻoili panakō i kahi ʻōlelo kuhi hewa"] --> NotepadTest{"E holo i ka Notepad Test: E kope i kahi ʻeke helu i ʻike ʻia-maikaʻi / IBAN a hoʻopili iā ia i ka Notepad (Ctrl+C -> Ctrl+V). Hoʻololi anei ka kikokikona i hoʻopaʻa ʻia?"}

    NotepadTest -->|"ʻAe: Hoʻololi ʻakomi i nā kikokikona i hoʻopaʻa ʻia ma nā kekona"| ClipperPath["VECTOR A: Hoʻopaʻa Paʻi Paʻi Paʻi ('Clipper') Malware ma kāu PC, Mac, kelepona, a i ʻole ka hoʻonui ʻana i ka polokalamu kele pūnaewele."]

    NotepadTest -->|"ʻAʻole: Noho like nā kikokikona i hoʻopaʻa ʻia (Ua kope ʻoe i ka helu like ʻole mai kāu mōʻaukala hana ponoʻī)"| PoisonPath["VECTOR B: Ma ka Chain Vanity Address Poisoning Scam (ʻAʻole i maʻi kāu hāmeʻa a me kāu huaʻōlelo huaʻōlelo)"]

    ClipperPath --> IsolateDevice["STEP 1A: Hoʻokaʻawale i ka PC / Kelepona i hoʻopili ʻia mai ka Pūnaewele -> Hoʻopono i ka chrome: //extensions & kaʻina hana hoʻomaka -> E nānā inā ʻaihue ʻo Broader Infostealer i nā Kuki Browser/Passwords"]

    PoisonPath --> TxStatus{"Ua hoʻolaha mua anei ʻoe i ka hana, a ua hōʻoia ʻia?"}
    IsolateDevice --> TxStatus

    TxStatus -->|"ʻAʻole i hoʻouna ʻia (Loa ʻia ma mua o ke kau inoa ʻana)"| SafeStop["Hoʻohou i kāu puke helu wahi ʻeke kālā / papa inoa keʻokeʻo me nā helu 42-Char piha i hōʻoia ʻia a ʻaʻole kope ʻia mai ka mōʻaukala hana."]

    TxStatus -->|"Ke kali nei ma Mempool (ʻAʻole i hōʻoia ʻia)"| RBF["URGENT: Broadcast Same-Nonce 0-ETH Self-Transfer (EVM) a i ʻole RBF Double-Spend (Bitcoin) me ka 50% ʻoi aku ka nui o ka uku kinoea e hoʻopau iā ia."]

    TxStatus -->|"Hoʻopaʻa ʻia ʻo On-Chain a i ʻole Bank Wire i hoʻouna ʻia"| AssetCheck{"He aha ke ʻano o ka waiwai i hoʻouna ʻia?"}

    AssetCheck -->|"USDT (Tether) a i ʻole USDC (Circle)"| FreezeToken["Waiho i ka mākaʻi/IC3 hōʻike + hoʻouna i ka Urgent Token Blacklist/Freeze Noi iā Tether/Circle + Monitor Attacker Address for CEX Deposit"]
    AssetCheck -->|"BTC / ETH / SOL"| TraceCEX["Loaʻa nā kālā ma o Etherscan/Arkham/MistTrack -> E hoʻouna i ka palapala hoʻokuʻu i ka hoʻokō kānāwai i ka Destination Exchange (Binance, Coinbase, Kraken, OKX) Ke waiho ʻia."]
    AssetCheck -->|"Uea Bank / SEPA IBAN / Uku wikiwiki"| WireRecall["Kāhea i ka hoʻouna koke ʻana i ka papa hoʻopunipuni Bank Wire Fraud no SWIFT MT192 / SEPA Recall + Hoʻomaopopo i ka loaʻa ʻana o ka mālama kālā."]

Pehea e hana ai nā hoʻouka ʻelua: Vanity Address Poisoning vs. Clipper Trojans¶

ʻOiai ʻo nā hoʻouka kaua ʻelua ka hopena i kāu kālā e hele ai i ka ʻeke kālā a ka mea hoʻouka kaua, ʻo kā lākou mau hana ʻenehana, a me ke ʻano o ia mea no ka palekana o kāu hāmeʻa, he kūʻē loa:

Māhele 1: He aha kāu e hana ai inā hoʻouna wale ʻoe i nā kālā i kahi wahi i hoʻopaʻa ʻia a i ʻole i kāʻili ʻia¶

Ana ʻia ka manawa i nā minuke ke ʻimi nei i nā hoʻololi ma ke kaulahao a hoʻomanaʻo paha i nā uea panakō. E hahai koke i kēia mau ʻanuʻu:

1. ʻAhuhi ʻia ka ʻimi a me ka hau hau USDT (Tether) a i ʻole USDC (Circle) On-Chain¶

No ka mea, ʻoi aku ka nui o 75 pakeneka o nā poho ʻona a pau ma ke kaulahao USDT (ma Tron TRC-20 a me Ethereum ERC-20) a USDC, loaʻa i ka poʻe i pōʻino ka pōmaikaʻi hoʻihoʻi koʻikoʻi i nele ʻo Bitcoin a me ETH maoli: centralized smart-contract freezing. 1. Wehe i kahi mea huli blockchain (etherscan.io, tronscan.org, solscan.io, arbiscan.io) a hoʻopili i kāu hash kālepa (TxID): - Kaomi ma ka Attacker's Recipient Address e ʻike inā ua ʻaihue ʻia kāu USDT a i ʻole USDC ke noho nei i loko o kā lākou ʻeke kālā a inā ua hoʻoneʻe lākou iā ia i kahi ʻeke "hop" waena. 2. ** Ina ka USDT a i ʻole USDC ke noho nei ʻo ia i loko o kahi ʻeke kālā waho (EOA) ma Ethereum, Tron, Solana, Polygon, Arbitrum, Base, a i ʻole Avalanche**: - ** Hoʻopili (USDT)** a me Poai (USDC) ua maloʻo ma mua o $1.8 biliona kālā i ʻaihue ʻia ma waena o nā kaukani helu wahi ma ke kelepona ʻana i ka ʻaelike akamai. AddedBlackList hana ma ka loaʻa ʻana o ka hoʻokō kānāwai a i ʻole nā ​​hōʻike hoʻopunipuni i hōʻoia ʻia. - E waiho koke mai: 1. He hōʻike pilikia ma FBI IC3 (ic3.gov), Action Fraud UK, Europol, a i ʻole kāu pākaukau cybercrime mākaʻi kūloko e kiʻi i kahi helu kuhikuhi hōʻike. 2. He hōʻike hoʻopunipuni lehulehu ma Chainabuse (chainabuse.com) a me ** Etherscan / Tronscan "Report / Flag Address"** no laila, nā API no ka palekana ʻeke kālā (Blockaid, Blowfish, Wallet Guard, Rabby, MetaMask) e hae koke i ka helu wahi o ka mea hoouka me ka ulaula no na mea hoohana. 3. He tikiki hoʻokuʻu koke i Tether Support (tether.to/en/contact-us) a me MistTrack / SlowMist / Seal 911 (@Seal_911 ma Telegram, ka Web3 Security Alliance 24/7 ulia pōpilikia pane hotline) me kāu TxID, hōʻailona manawa UTC pololei, a me ka mākaʻi/IC3 kuhikuhi. 3. Inā hoʻoneʻe ka mea hoʻouka i ka crypto i ʻaihue ʻia i loko o kahi Centralized Exchange (CEX) Waihona helu (Binance, Coinbase, OKX, Kraken, Bybit, HTX, KuCoin, Gate.io): - E hoʻomaopopo i ka ** inoa pololei ʻo Exchange Hot Wallet ** i hōʻailona ʻia ma Etherscan/Tronscan/Arkham a me ka ** pololei TxID o ka waiho ana iloko o kela hoololi**. - He 24/7 Law Enforcement & Victim Asset Freeze Portal i kēlā me kēia hoʻololi kikowaena nui ** (Binance Law Enforcement Request / Customer Support Case, Coinbase Support, OKX Risk Control). Waiho mai i ka ** Waihona TxID i ka papa kākoʻo o kēlā hoʻololi koke a noi iā lākou e kau i kahi ** hoʻopaʻa hoʻokō no ka manawa 7 lā ma ka waihona waihona i loaʻa ka waihona. TxID [Hash] ʻoiai ke hoʻouna aku nei nā luna kānāwai i kahi kauoha manuahi manuahi**.

2. Hoʻomanaʻo ʻana i kahi Uea Bank i hoʻololi ʻia (IBAN / Account Number Hoʻololi ʻia e Clipper Malware)¶

Inā he trojan clipper banking (ClipBanker, Qakbot, ZeuS/ZLoader) ua hoʻololi i ka mea hoʻolako a i ʻole ko ke konohiki IBAN a i ʻole ka helu routing/helu helu i ka wā i hoʻopili ai ʻoe iā ia i kāu puka waihona waihona pūnaewele: 1. Kāhea i kāu pēke Wire Fraud / Treasury Recall Desk i loko o ka hola mua a noi i kahi Fraudulent Wire Recall (SWIFT MT192 / SEPA SCT Recall / Faster Payments APP Fraud Claim). 2. E nānā i ka Bank Identifier Code (BIC) / Helu Alanui i hoʻokomo ʻia i loko o ka mea hoʻouka kaua IBAN (nā huaʻōlelo 5 a hiki i ka 8 o kēlā me kēia ʻEulopa/UK IBAN e hoʻomaopopo i ka panakō e loaʻa pololei ana) a kāhea aku i ka keena hoʻopunipuni o ka panakō lawe pololei e hōʻike i kēlā moʻokāki [Attacker IBAN] he money-mule moʻohelu kālā e loaʻa ana nā kālā i loaʻa mai ka hoʻopunipuni polokalamu polokalamu clipboard.

Māhele 2: ʻIke a Hoʻopau ʻana i ka mea hoʻoheheʻe pahu pahu ("Clipper") Malware¶

Inā hōʻike kāu Notepad Copy-Paste Test ʻo ke kope ʻana i kahi helu crypto a i ʻole IBAN a hoʻopili iā ia e hoʻololi koke i ka kikokikona (a i ʻole inā manaʻo ʻoe he clipper kāu PC, Mac, a i ʻole kelepona Android), e hahai i kēia kaʻina wehe forensic ma mua o ka hoʻohana ʻana i ka hāmeʻa no kekahi hana kālā:

1. E nānā mua i ka hoʻonui ʻia ʻana o ka polokalamu kele pūnaewele (Ke kumu #1 o nā Cross-Platform Clippers)¶

Hūnā pinepine ka poʻe hoʻouka kaua i kēia manawa i ka JavaScript e hoʻololi ana i ka clipboard i loko o nā hoʻonui polokalamu ʻike hewa ʻole (PDF converters, ad blockers, volume boosters, dark mode toggles, fake MetaMask/Phantom/Ledger helper extensions, a i ʻole ChatGPT sidebar tools) me ka hoʻohana ʻana i ka polokalamu kele pūnaewele navigator.clipboard.writeText() a i ʻole document.execCommand('copy') Nā API: 1. Wehe chrome://extensions (a i ʻole edge://extensions, brave://extensions, about:addons ma Firefox). 2. Holo a Wehe i kēlā me kēia hoʻonui ʻaʻole ʻoe e hilinaʻi 100%, a i ʻole e hoʻāʻo i ka hoʻopili ʻana i loko o kahi Incognito / Private Window (kahi i hoʻopau ʻia nā hoʻonui ʻia ma ka paʻamau). 3. Inā pau ka hoʻololi ʻana o ka clipboard i kou hoʻopau ʻana i kahi hoʻonui polokalamu kele pūnaewele, kaomi i ka Report Abuse a me Remove, a laila e hahai i kā mākou alakaʻi hoʻomaʻemaʻe polokalamu kele pūnaewele piha: nā hoʻonui polokalamu ʻino, nā hijackers clipboard, a me ka wehe ʻana i nā mea hoʻolaha.

2. ʻIke a pepehi ʻana i nā Trojans Native OS Clipper ma Windows, macOS, a me Android¶

Inā hoʻololi ka clipboard i kāu helu ʻeke kālā inā ʻoe e kope a paʻi i loko Notepad.exe a i ʻole TextEdit me ka paʻa loa o kāu polokalamu kele pūnaewele, ke holo nei ka ʻokiʻoki ma ke ʻano he kaʻina hana ʻōnaehana ʻōnaehana kumu:

Ma ka Windows 10/11:¶

1. **Hoʻokaʻawale koke i ka PC mai Wi-Fi a me Ethernet ** (nui nā clippers like Laplas Clipper e nīnau i kahi kikowaena C2 pūnaewele i kēlā me kēia manawa āu e kope ai i kahi helu wahi e hiki ai iā lākou ke hoʻihoʻi i kahi helu kuhi hewa like ʻole; ʻO ka ʻoki ʻana i ka ʻike pūnaewele e hoʻōki i ka swap a i ʻole e hoʻihoʻi i ka polokalamu malware i kahi helu paʻa paʻa, a pale i ka concurrent. infostealer malware mai ka hoʻouka ʻana i kāu mau faila).
2. E hoʻohana i ka Process Explorer a i ʻole PowerShell e hopu i ke kaʻina hana ʻino e paʻa ana i ka Chain Clipboard: E wehe i kahi pukaaniani Administrator PowerShell a papa inoa i nā kaʻina hana holoʻokoʻa ʻole ʻo Microsoft e hoʻokō ana mai nā papa kuhikuhi hiki ke kākau ʻia (%APPDATA%, %LOCALAPPDATA%, %TEMP%, C:\ProgramData):

   Get-CimInstance Win32_Process | Where-Object { $_.ExecutablePath -match "AppData|Temp|ProgramData|Public" } | Select-Object ProcessId, Name, ExecutablePath, CommandLine | Format-Table -AutoSize
   

3. E nānā i ka hoʻomaka ʻana o Windows (Scheduled Tasks a Run Ki): ʻO 90 ka nui o ka Windows clippers e hoʻomau ma o kahi Scheduled Task a i ʻole kahi Registry Run kī e hoʻolana a .vbs, .bat, .ps1, a i ʻole .exe huna iloko %APPDATA%:

   Get-ScheduledTask | Where-Object { $_.TaskPath -notmatch "\\Microsoft\\" -and $_.State -ne "Disabled" } | Select-Object TaskName, TaskPath, @{N="Actions";E={$_.Actions.Execute + " " + $_.Actions.Arguments}}
   

   A e nānā i nā kī hoʻopaʻa inoa hoʻomaka o kēia manawa:

   Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run", "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
   

4. NĀ MEA KĀWAI: ʻaneʻane ʻaʻole hele wale ʻo Clippers ma Windows a i ʻole macOS: I loko o nā hoʻolaha hoʻopaʻapaʻa cybercrime hou (Lumma Stealer, RedLine, Vidar, Stealc, Atomic macOS Stealer), ʻo ka Clipper module ʻo ia wale nō ka uku hoʻomau hope loa i waiho ʻia ma hope o ka ʻoki ʻana o kahi Infostealer i kēlā me kēia ʻōlelo huna i mālama ʻia, cookie session, a me ka lako polokalamu crypto-wallet vault (MetaMask Local Extension Settings .ldb waihona, Electrum, Exodus, Atomic) mai kāu kamepiula.
5. Inā loaʻa iā ʻoe ka malware clipper maoli ma kāu PC a i ʻole Mac, e manaʻo ʻoe i kēlā me kēia putele lako polokalamu (MetaMask, Phantom, Rabby, Trust, Exodus) a me kēlā me kēia kau polokalamu kele pūnaewele i hoʻopaʻa ʻia ma kēlā mīkini ua hoʻopaʻa ʻia hoʻi.
6. E hoʻohana i kamepiula kaʻawale, maʻemaʻe a i ʻole kelepona no ka hoʻololi ʻana i ke koena crypto a pau mai loko mai o nā ʻeke wela wela i loko o kahi Hardware Wallet (Ledger, Trezor, Keystone, Coldcard) huaʻōlelo huaʻōlelo, hoʻopau i nā kau polokalamu kele pūnaewele a pau, a hana i kahi hoʻouka hou o OS maʻemaʻe.

Ma macOS:¶

1. E wehe i ka Terminal a e nānā i nā mea ʻaʻole Apple LaunchAgents a me nā kaʻina hana hope:

   ls -la "$HOME/Library/LaunchAgents" /Library/LaunchAgents /Library/LaunchDaemons
   

2. Inā ʻike ʻoe i kahi kamaʻāina ʻole .plist faila e hoʻomaka ana i kahi binary mai /tmp/, /Users/Shared/, a i ʻole $HOME/Library/Application Support/, wehe a holoi iā ia, a laila scan me Malwarebytes no Mac a i ʻole ** Objective-See KnockKnock**.

Ma nā kelepona Android:¶

• Hoʻopili pinepine ʻia nā ʻāpana Android e like me ka hoʻouka ʻana i ka ʻaoʻao hoʻopunipuni .apk nā polokalamu (Fake Telegram, Fake WhatsApp, Fake Authenticator, a i ʻole nā pāʻani mākia) i hāʻawi ʻia i ka Accessibility Service i nā ʻae (no ka mea, ua kaupalena ʻo Android 10+ i ka heluhelu ʻana i ka papa kiʻi kiʻi hope inā ʻaʻole he app ka papa kuhikuhi kumu hoʻokomo. IME a i ʻole e paʻa i kahi overlay Accessibility hana).
• E hele i Settings > Accessibility > Installed Apps a me ** Settings > System > Keyboard > On-screen keyboard** a wehe koke i kekahi polokalamu ʻike ʻole ʻia.

Māhele 3: ʻO nā pale paʻa e kūʻē i nā mea ʻawaʻawa a me nā mea hoʻoheheʻe Clipper¶

Ke hoʻohana ʻoe i kēia mau hana hana ʻelima, ʻaʻole hiki i kahi $100,000 GPU vanity-address poisoning farm a i ʻole kahi trojan clipboard stealth hiki ke hoʻopunipuni iā ʻoe i ka hoʻouna ʻana i ke kālā i kahi huakaʻi hewa.

• 1. Ka "Middle-6 + Mua-4 + Hope-4" Rula Hōʻoia Nānā:
• Mai nānā wale i nā huaʻōlelo 4 mua a me 4 hope o kahi helu ʻeke kālā a i ʻole IBAN.
• No ka hana ʻana i kahi helu vanity e like me 8 mau huaʻōlelo waho (4 prefix + 4 suffix, ma kahi o 4.29 biliona hui pū ʻana) e lawe i kahi puʻupuʻu GPU hou ma lalo o 2 kekona, hiki i nā mea hoʻouka ke hoʻohālikelike i nā hopena o kāu helu wahi.
• Eia nō naʻe, hiki ʻole ke hoʻohālikelike i kahi 6 huaʻōlelo hou ma ka waena pono o ka helu wahi (ma kahi o 72 quadrillion hui pū ʻana) ʻaʻole hiki ke hoʻopaʻa ʻia no nā bots make. E hōʻoia mau ʻo nā huaʻōlelo 4 mua, 6 mau huaʻōlelo ma ka waena pololei, a me nā huaʻōlelo 4 hope e kūʻē i ke kumu kumu ma mua o ke kau inoa ʻana.
• 2. Mai kope i kahi helu wahi mai kāu moʻolelo "Nā Hana Hou" a i ʻole Etherscan/Tronscan Activity Tab:
• E mālama i ka pā "Transaction History / Activity" o kāu pēke ma ke ʻano he "graffiti lehulehu ʻole i hilinaʻi ʻia ** kahi e hiki ai i kekahi ma ka Honua ke hoʻoheheʻe i ka hoʻopunipuni. $0.00 nā hoʻoili ʻana a me nā ʻōlelo like.
• Akā, e mālama i kēlā me kēia mea e loaʻa hou ana, ʻeke waihona anu, a me ka helu wahi waiho hoʻololi i loko o ka Buke Address Built-in / Contacts Whitelist me kahi lepili hiki ke heluhelu ʻia e ke kanaka ("My Coinbase USDC Deposit", "Hardware Ledger Vault #1") a koho pono i ka mea i loaʻa mai kāu Buke Address i mālama ʻia.
• 3. E hoʻololi i nā ʻeke ʻeke palekana-Mua e hōʻailona ʻakomi i nā wahi ʻona a me ka manawa mua (Rabby, MetaMask Blockaid, Phantom):
• ʻO nā pēke Web3 hou e like me Rabby Wallet a me MetaMask (me nā makaʻala palekana Blockaid i hoʻohana ʻia) e aʻo iā ʻoe me ka ʻulaʻula ʻulaʻula ma mua o kou kau inoa inā:
  • ʻO ia ka mua loa i hoʻouna aku ai ʻoe i ka waiwai maoli i kēia helu kikoʻī kikoʻī 42 ("Warning: First-time transfer to this address"), ka hopu ʻana i ka ʻawaʻawa no ka mea ke manaʻo nei ʻoe e hoʻouna ana ʻoe i kahi helu kamaʻāina kahiko inā ʻoiaʻiʻo ʻaʻole ʻoe i hoʻouna i ke kālā i ka helu like o ka mea hoʻouka kaua ma mua.
  • He helu like kiʻekiʻe ka helu wahi e hele ai (Levenshtein distance) i kekahi helu wahi ma kāu moʻolelo ("Address Poisoning Detected").
• 4. E hōʻoia mau i ka helu wahi holoʻokoʻa ma ka pale kino o kahi ʻeke Lako Paʻa (Ledger, Trezor, Keystone, Coldcard, GridPlus):
• ʻOiai inā hoʻololi ʻo Clipper Malware ma kāu PC maʻi i ka helu wahi ma kāu kamepiula (a i ʻole inā hoʻopaʻa ʻia kāu polokalamu kele pūnaewele ʻo DOM e hōʻike i ka ʻoiaʻiʻo helu i loko o Chrome i ka wā e hāʻawi ana i ka helu ka mea hoʻouka * i ka noi hoʻopaʻa inoa USB), ** ʻaʻole hiki i ka polokalamu ma kāu PC ke hoʻololi i ka mea i hōʻike ʻia ma ka pale EAL5+/EAL6+ Secure Element* o kāu ʻeke ʻeke kino kino.
• E hoʻohālikelike i ka helu wahi i hōʻike ʻia ma ka ʻOLED kino o kāu pēke paʻa i kahi ** mea kūʻokoʻa kūʻokoʻa ʻelua ** (no ka laʻana, ke nānā ʻana i ka invoice a i ʻole QR code ma kāu kelepona ʻoiai ke kau inoa ʻana ma kāu pēke lako PC).
• 5. E hoʻouna i kahi hana hoʻāʻo liʻiliʻi inā kope hou ʻoe mai ke kumu kumu i hōʻoia ʻia:
• E nānā i kahi pahele maʻalahi: Nui ka poʻe i loaʻa i ka Vanity Address Poisoning i makaʻala loa a ua hoʻouna lākou i kahi $10 test transaction ka mua. Ua nalowale lākou he $50,000 ma ka lua o ka hana ʻana no ka 60 kekona ma hope o kā lākou $10 hōʻoia hōʻoia i hoʻopaʻa ʻia ma ke kaulahao, ua ʻona ka bot automated a ka mea hoʻouka i kā lākou moʻolelo kālepa me kahi helu like, a i ka wā i hele ai ka mea i pepehi ʻia e hoʻouna i ke koena $ 50,000, ua kope lākou i "ka helu aʻu i hoʻouna aku ai i $ 10 i" mai kā lākou Recent Transactions list.
• Inā hoʻouna ʻoe i kahi hana hoʻāʻo, e mālama i ka helu wahi i hōʻoia ʻia i loko o kāu Address Book *ma mua o ka hoʻouna ʻana i ka hoʻāʻo, a koho i kēlā helu helu helu helu no ka hoʻoili nui.

Nā helu ulia pōpilikia āpana a me nā protocols oihana¶

Inā ua hoʻohuli ʻia kāu kālā e ka make ʻana o ka leka uila a i ʻole clipboard malware, pono e hōʻike koke i ka hoʻokō kānāwai a me nā papa naʻauao blockchain e koi ai i nā hoʻololi kikowaena (CEXs) a me nā mea hoʻopuka stablecoin (Tether / Circle) e hoʻokuʻu a hoʻihoʻi i nā waiwai ʻaihue:

• ** ʻAmelika Hui Pū ʻIa a me Kanada**:
• Nā Hana Kūikawā: Kāhea 911 ina he hooweliweli kino.
• FBI Internet Crime Complaint Center (IC3): E waiho i kahi hōʻike hoʻopunipuni a i ʻole ka hoʻopunipuni uea ma ic3.gov (no ka uea nui a i ʻole nā ʻaihue crypto i loko o nā hola he 72 i hala, e kaha i ka hoʻopiʻi no ka IC3 Recovery Asset Team RAT a hoʻokomo i ka pololei TxID, pūnaewele blockchain, aelike hōʻailona, a me ka helu wahi ʻeke kālā hoʻouka kaua).
• U.S. lawelawe malu (USSS) Cyber Fraud Task Force & CISA: E hoʻokaʻaʻike i kāu USSS Field Office no nā hoʻololi crypto/wire nui a i ʻole e hōʻike i nā hōʻailona malware iā cisa.gov/report.
• Canadian Anti-Fraud Center (CAFC): Hōʻike ma antifraudcentre-centreantifraude.ca aiʻole 1-888-495-8501 a waiho i kahi hōʻike me kāu ʻāpana cybercrime police municipal.
• United Kingdom:
• Nā Hana Kūikawā: Kāhea 999 (a i ʻole 101 no ka makai pilikia ole).
• Action Fraud: Kāhea 0300 123 2040 koke (24/7 no ke ola cyber/ke kalaima kālā e holomua ana) a i ʻole hōʻike ma actionfraud.police.uk. No nā hoʻoili panakō i hoʻololi ʻia e ka malware, e kelepona koke i kāu panakō ma lalo o UK ** Faster Payments Authorized Push Payment (APP) Hoʻihoʻi hoʻopunipuni** lula.
• Uni ʻEulopa:
• Nā Hana Kūikawā: Kāhea 112 ma nā mokuʻāina lālā a pau o EU.
• Europol National Cybercrime Units: E waiho i kahi hōʻike makai koke ma o europol.europa.eu/report-a-crime/report-cybercrime-online (koi ʻia e Tether, Circle, a me nā hoʻololi nui ma lalo o EU MiCA / AML frameworks e mālama i kahi waiwai paʻa ma mua o kahi paʻa pilikia mua).
• Australia a me New Zealand:
• Nā Hana Kūikawā: Kāhea 000 ma Australia a i ʻole 111 ma Aotearoa.
• ReportCyber (ACSC Australia): Hōʻike ma cyber.gov.au/report-and-recover/report a i ʻole kelepona 1300 CYBER1 (1300 292 371).
• CERT NZ (New Zealand): Hōʻike ma cert.govt.nz.
• India a me Asia-Pākīpika:
• Laina Kokua ma ka Lahui Cyber Crime Lahui o India: Kāhea 1930 koke a hōʻike ma cybercrime.gov.in.
• ** Puali Makai o Singapore (SPF) Kikowaena Anti-Scam & Makai o Hong Kong (ADCC)**: Kāhea 1800-722-6688 (Singapore) a i ʻole 18222 (Anti-Deception Coordination Centre Hong Kong).

Nīnau pinepine¶

Ina a $0.00 USDT Ua hōʻike ʻia ka hoʻoili ʻana i loko o kaʻu ʻeke ma ke ʻano he "Hoʻouna ʻia mai kaʻu helu wahi" i kahi helu ʻē, ʻo ia ke ʻano o ka hacker kaʻu huaʻōlelo huaʻōlelo a i ʻole kī pilikino?¶

ʻAʻole, palekana loa kāu huaʻōlelo huaʻōlelo a me nā kī pilikino. Ma ka Ethereum maʻamau (ERC-20), Tron (TRC-20), a me BNB Chain (BEP-20) hōʻailona akamai aelike, ka transferFrom(mea hoʻouna, loaʻa, nui) nānā ka hana inā he ʻae ka mea kelepona e neʻe nui nā hōʻailona ma kou inoa (`allowance >= amount`). No ka mea, ʻo kāu hāʻawi paʻa i kahi malihini 0, a hala ka malihini nui = 0, e nānā ka ʻaelike akamai inā 0 >= 0 (ʻo ia hoʻi ʻOiaʻiʻo) a ʻae i kekahi ma ka Honua e hoʻopuka i kahi hoʻopunipuni 0.00 USDT hoʻololi i ka hanana me kāu pēke i helu ʻia ma ke ʻano he mea hoʻouna, me ka loaʻa ʻole o kāu kī pilikino a ʻae ʻia. ʻO ka mea hoʻouka wale nō i hana i kēia no ke kanu ʻana i kā lākou helu like i loko o ka papa inoa "Recent Activity" o kāu ʻeke.

Pehea i hana ai ka mea hacker i kahi helu peke kālā e hoʻomaka me nā huaʻōlelo 5 like a hoʻopau ʻia me nā huaʻōlelo 5 like me kaʻu helu maoli?¶

ʻO nā helu ʻeke kālā Cryptocurrency nā hashes lehulehu i loaʻa ma ka makemakika mai kahi kī pilikino. ʻOiai ʻaʻole hiki ke hoʻohuli hou i ke kī pilikino o kāu helu kikoʻī 42 kikoʻī, he mea hoʻouka kaua e hoʻohana ana i kahi pūʻulu o nā kāleka kiʻi kūʻai (`GPUs` holo mea paahana like `profanity2` a i ʻole `vanity-eth`) hiki ke hana mau piliona hui kī kīkēkē i kekona a e hoʻolei wale aku i kekahi helu wahi ʻaʻole e hoʻomaka me kāu mau huaʻōlelo 4-5 mua a hoʻopau me kāu mau huaʻōlelo 4-5 hope loa. Ma muli o ka hoʻohālikelike ʻana i nā huaʻōlelo hexadecimal 8 a 10 wale nō e koi ai i ka hoʻāʻo ʻana i ka 4.3 biliona a i ka 1 trillion hashes, hiki i kahi kikowaena multi-GPU ke hoʻopuka i kahi helu like prefix-a-suffix ma kekona, ʻoiai ʻo ka waena 30 mau huaʻōlelo e hoʻomau wale ʻia.

Hiki iā Clipper Malware ke hoʻololi i kahi helu Ethereum a i ʻole Bitcoin ma hope o koʻu hoʻopili ʻana iā ia ma kahi ʻaoʻao pūnaewele?¶

Hoʻololi wale ka polokalamu ʻōnaehana ʻōnaehana ʻōnaehana maʻamau i ke kikokikona e noho ana i loko o kāu pale pahu pahu ʻōnaehana ma waena o ka manawa āu e kaomi ai Ctrl+C a me ka manawa e kaomi ai Ctrl+V. Eia naʻe, inā e holo ana ka malware i loko o kāu polokalamu kele pūnaewele ma ke ʻano he hoʻonui ʻino ʻo Chrome/Edge/Firefox, loaʻa iā ia ke komo piha heluhelu-kākau i ka Palapala Hoʻohālike o ka ʻaoʻao pūnaewele (DOM) a hiki ke hoʻololi mālie i ka helu wahi e hele ai i loko o kahi pahu hoʻokomo pūnaewele ma ke kaomi ʻana i ke pihi "Submit". ʻO ia ke kumu e hōʻoia mau ai ʻoe i ka helu piha ma ka pale kino o kahi ʻeke kālā ma mua o ke kaomi ʻana i ke pihi hōʻoia kino.

Ke hoʻohana nei i ka inoa ENS (vitalik.eth) a i ʻole Solana .sol hoʻomalu iaʻu mai ka hoʻopaʻa inoa ʻana a me ka malware clipper?¶

Ke hoʻohana nei i nā inoa ENS hiki ke heluhelu ʻia e ke kanaka (`alice.eth`) kōkua i ka pale ʻana i ke kope ʻana i kahi helu hexadecimal ʻona mai kāu mōʻaukala kālepa, inā ʻoe e paʻi pololei i ka inoa ENS ma ka lima ma mua o ke kope a paʻi ʻana. E makaʻala i ʻelua mau pahele ENS: ʻO ka mea mua, hoʻopaʻa inoa nā mea hoʻouka i ka homograph / typo-squatted ENS domain me ka hoʻohana ʻana i nā huaʻōlelo unicode zero-width i ʻike ʻole ʻia a i ʻole nā ​​leka like ʻo Cyrillic (`aIice.eth`). ʻO ka lua, e hōʻoia mau i ke kumu i hoʻoholo ʻia 0x... Hexadecimal helu wahi i hōʻike ʻia ma kāu ʻeke ʻeke lako lako e pili ana i ka helu ʻoiaʻiʻo o ka mea loaʻa.

Inā hoʻouna hewa wau i ke kālā i kahi helu ʻona, hiki iaʻu ke hoʻouna i kahi leka ma ke kaulahao i ka hacker e hāʻawi ana i ka 10% a i ʻole 20% "white-hat bounty" e hoʻihoʻi i ke koena?¶

ʻAe, e hoʻouna ana i kahi leka uila UTF-8 i hoʻokomo ʻia i loko o ka ʻIkepili hoʻokomo (Hex) kahua o kahi hana liʻiliʻi i ka helu wahi o ka mea hoʻouka kaua (e hōʻike maopopo ana i ka hoʻokō ʻana i ke kānāwai a me Tether/Circle/Exchange freeze noi e waiho ʻia ana, a hāʻawi i kahi makana maʻemaʻe 10% a 20% inā hoʻihoʻi ʻia ka 80% a 90% o nā kālā i loko o 24 mau hola) USDT a i ʻole USDC ua ʻike ka mea hoʻouka iā Tether a i ʻole Circle e kokoke ana i ka papa inoa ʻeleʻele a paʻa mau loa i loko o kā lākou ʻeke. E hoʻopaʻa mau i kāu noi ʻo Tether/Circle freeze a me ka hōʻike mākaʻi e like me ka hoʻokaʻulua ʻole.

Nā alakaʻi pili¶

• ʻO nā mea hoʻonui polokalamu ʻino, nā hijackers clipboard, a me ka wehe ʻana i nā mea hoʻolaha
• ʻO ka hoʻoheheʻe kālā Cryptocurrency a me nā huaʻōlelo huaʻōlelo
• ʻO ka hoʻopaʻapaʻa leka uila ʻoihana ʻoihana (BEC) a me ka hoʻomanaʻo hoʻopunipuni uea
• ʻO ka hoʻopaʻa ʻana i nā kuki hui, ka polokalamu infostealer, a me ka hoʻopau ʻana i ka passkey
• Pua-butchering crypto hoʻopukapuka scam a me ke aloha DeFi hoʻihoʻi hoʻopunipuni
• Nā helu pilikia ma ka ʻāina

Nā kumu a me ke alakaʻi kūhelu¶

• Federal Bureau of Investigation (FBI) Ke kikowaena hoʻopiʻi hewa pūnaewele (IC3) & ʻOihana Malu ʻAmelika (USSS): Nā hoʻolaha hoʻolaha no ka Cryptocurrency Vanity Address Poisoning (Zero-Value Token Transfer) Hoʻouka ʻia a me nā mea hoʻoheheʻe ʻia ʻo Clipboard Hijacker Malware.
• Keʻena palekana Cybersecurity a me Infrastructure Security Agency (CISA) & MITRE ATT&CK Framework (Technique T1115: Clipboard Data): Ka ʻike ʻana a me ka hoʻēmi ʻana i ka nānā ʻana a me ka hoʻololi ʻana i nā Malware (ClipBanker, Laplas Clipper).
• SlowMist & Web3 Security Alliance (SEAL 911) Nā Hōʻike Noʻonoʻo: On-Chain Analysis of ERC-20 / TRC-20 transferFrom ʻAi ʻAi ʻAi ʻAi Waiwai ʻAʻole, ʻAi ʻAi ʻAi ʻAi ʻAi ʻAi ʻAi ʻAi ʻAi ʻAi, a me USDT/USDC Nā kaʻina hana papa inoa ʻeleʻele pilikia.
• Kikowaena Cyber ​​​​Lahui (NCSC) (United Kingdom) & European Union Agency for Cybersecurity (ENISA): *Hoʻopaʻa ʻia i nā ʻoihana kikohoʻe waiwai, hōʻoia ʻana i ka ʻeke ʻeke paʻa, a me ka hoʻihoʻi hou ʻana i ka uku hoʻopunipuni.