Bintu bibi bia kuenza nabi mudimu, bena tshinyangu tshia Crypto, ne dilongolola dia tshiamu tshia mudimu¶

Kumona ne adrese wa tshibutshilu tshia makuta a tshianana (BTC, ETH, SOL, USDT) anyi nomba wa IBAN wa banke/routing uudi muangate nende Ctrl+C (Cmd+C) wakashintuluka mu mushindu wa tshishima kuluaye adrese wa muntu uudi kuyi mumanye dîba diuvua mufina Ctrl+V (Cmd+V), kupeta ne tshiamu tshia Chrome, Edge, Brave, anyi Firefox tshiuvua muteke kukadi bidimu bia bungi ("PDF Converter", "Volume Booster", "Video Downloader", anyi "AI Assistant") tshivua tshisumbishibue mu musokoko kudi tshisumbu tshia adware ne mpindieu tshidi tshibueja ma-link a tshinyangu ne tshikuata cookies ya tshisangilu tshiebe, anyi tshikebelu tshiebe tshia tshikebelu tshia kumpala dibeji dia dilombola didi dikuata muinshi mua mukenji "Tshiamu tshiebe tshidi tshilombodibua kudi bulongolodi buebe" ntshilumbu tshikole tshia ku ndekelu. Bualu bua biamu bia lelu bia ku Enternete bidi ne cookies yebe ya tshisangilu tshia Gmail, Microsoft 365, biamu bia mudimu bia mu ditu, biamu bia kulama nabi meyi a tshisokomenu, ne Web3 wallets, tshiamu tshimue tshia kubandila natshi malu tshia tshianana tshidi tshianyishibue "Read and change all your data on all websites" (<all_urls> anyi *://*/* bukokeshi bua muena nzubu) udi upitshila ku Multi-Factor Authentication (MFA) mujima pa kubala bintu biebe bia DOM, dikuma dia tumanyinu, ne navigator.clipboard buffer mu tshikondo tshilelela.

Shi tshinyangu tshia navigateur tshidi tshisangisha ne dikuata dia bintu bia bantu, ditshinyisha dia ku mubidi, anyi dikuata dia bintu bia kumpanyi didi dienda dienzeka, bikila nimero wa njiwu wa muaba unudi (911 mu États-Unis ne mu Canada, 112 mu matunga masanga a ku Mputu, 999 mu Royaume-Uni) anyi tangila mukanda wetu wa malu a pa buloba bujima nomba ya tshimpitshimpi mpindieu. Bua bilumbu bionso bia dilengeja dia tshikebelu tshibi, tshiamu tshia crypto clipboard clipper, anyi dikuata dia mikenji ya tshikebelu, enza mudimu wa diumusha ne dijimija dia tshisangilu tshidi kuinshi eku.

Enza nunku mpindieu¶

1. LEKA kuela bintu bia mushinga mukole (Ctrl+V / Cmd+V) ne kuena mua kuitaba mudimu wa makuta a tshianana kuyi mujadike maleta 6 a kumpala ne 6 a ndekelu adi pa tshiamu tshieba tshia makuta: Clipboard hijacker malware ("Clippers" / CrypToClipper) udi wenza mudimu ne miaku ya pa tshibidilu (RegEx) bua kutangila tshiamu tshieba tshia mudimu ne tshiamu tshieba tshia kubandila natshi bintu kunyima kua 100 milliseconde yonso. Dîba diudi ukopolola 0x... Adelese wa Ethereum, bc1... Adelese wa Bitcoin, anyi adrese wa Solana, udi ushintulula bintu bidi mu tshibuta tshia mikanda ne adrese udi umueneka bu wa muntu udi uluisha.
2. Umbusha ordinatere udi ne disama edi ku Wi-Fi / Ethernet kumpala kua kumukangula chrome://extensions (edge://extensions / about:addons): Ma extensions mabi a bungi adi atangila muntu udi uya ku tab wa dilombola dia extensions ne udi mua kukanga tab au nkayende, kudisokoka, anyi kuenza exfiltration dump wa ndekelu wa cookies yebe ya session open kumpala kua wewe kuela Remove. Kujika Wi-Fi kumpala kudi kupangisha bukokeshi buabu (C2) njila.
3. Jima "Extensions Sync" mu konte webe wa Google, Microsoft, anyi Mozilla KUMPALA kua wewe kujimija extension wa rogue: Shi Chrome Sync, Edge Sync, anyi Firefox Sync mikale mienzeja, dijimija dia extension mubi pa tshiamu tshieba tshia ku bianza ditu dipanga bualu profil webe wa mu matutu anyi tshiamu tshikuabu tshidi tshibuela mu tshiamu tshiebe tshidi tshipingaja tshiamu tshieba tshia mudimu mu minite mikese pashishe. Ndaku ku chrome://settings/syncSetup/advanced (edge://settings/profiles/sync) ne ushintulule Extensions ku OFF kumpala.
4. Funda ID wa maleta 32 (Developer Mode -> ID) ne kumbusha tshitupa tshia pa mutu NE muaba uditshi IndexedDB / Local Extension Settings tshilaminu tshia diske: Kumpala kua kututa pa Kumbusha, teka Mushindu wa dienza mu ditumba dia kuulu dia dia balume dia chrome://extensions ne funda ID wa maleta 32 (tshilejilu, aeblfdkhhhdcdjpifhhbdiojplfjncoa). Kumanya ID mulelela kudi kukuambuluisha bua kujadika ni tshitupa etshi tshivua tshimanyishibue bu tshintu tshibi ne kumbusha tshilaminu tshiatshi tshidi tshishale munda mua muaba uudi musombele AppData / Library tshilaminu.
5. Kumbusha mikenji ya dishima ya tshikebelu tshia mudimu (chrome://policy ne edge://policy) udi wamba ne: "Tshiamu tshieba tshidi tshilombodibua kudi bulongolodi buebe": Pa ordinatere wa ku nzubu, kumona "Mulombodibua kudi bulongolodi buebe" kudi kumvuija ne: adware anyi trojan mmufunde tshintu tshibi ExtensionInstallForcelist anyi SearchProvider funda mu tshilaminu tshieba tshia Windows (HKLM\SOFTWARE\Policies\Google\Chrome) anyi MacOS Configuration Profiles (System Settings -> General -> Device Management) nunku kuena mua kutua pa butone bua kumbusha to.
6. Umbusha bipese bionso bia tshikondo tshia tshikebelu tshia mudimu biiba pa kututa pa "Patuka mu bikondo bionso" ku tshiamu tshikezuke: Bualu tshintu tshibi tshidi ne <all_urls> dianyisha anyi chrome.cookies access udi mumane kukopa bimanyinu biebe bia kubuela mu konte webe, anu kujimija tshitupa etshi kakuena kupatula muntu udi ukubunda mu konte yebe to. Wenza mudimu ne telefone mukezuke bua kuenzeja Kupatuka mu biamu bionso / Kumbusha bisangilu ku e-mail webe, ku banke, ku matutu, ne ku konte yebe ya malu a bantu, ne kushintulula meyi ebe a tshisokomenu bilondeshile malu etu diandamuna dia dishipa dia mikenji ne bulombodi bua dipatuka dia meyi a tshisokomenu.

Mutshi wa mapangadika: kutapulula njiwu ya dilengeja dia tshikebelu, bena tshinyangu tshia mikenji, ne bena OS clippers¶

Londa tshikandakanda etshi bua kumanya tshitupa kayi tshia tshiamu tshieba tshia kutangila natshi bintu anyi tshiamu tshiebe tshia mudimu tshidi tshinyanguke ne kujikija mushindu wa ditantamana:

flowchart TD
    Start["Dipanga dia tshikebelu dimueneka: adrese wa clipboard mushintuluke, dikebulula dishintulula, bipese bia dishima, anyi tshisangilu tshia konte tshiiba"] --> Test{"1. Kanga tshikebelu tshijima ne funda/ela adrese wa Crypto mu Notepad / TextEdit: Bidiku bishintuluka anyi?"}
    Test -->|"Eyowa: Adelese udi ushintuluka pambelu pa tshikebelu"| OSClip["OS-LEVEL CLIPPER MALWARE: Kill Rogue Process in Task Manager, Purge Scheduled Tasks / Run Keys & Run Offline AV Scan"]
    Test -->|"Tòo: Bidi bienzeka anu munda mua tshikebelu"| PolicyCheck{"2. Fungula chrome://policy anyi edge://policy: Mikenji idi mifunda pa ordinatere webe wa ku nzubu anyi?"}
    PolicyCheck -->|"Eyowa: 'Mulombola kudi bulongolodi buenu' / ExtensionInstallForcelist"| WipePolicy["Kumbusha mishindu ya difunda dia Windows (mikenji ya HKLM/HKCU) anyi kumbusha tshimfuanyi tshia macOS"]
    PolicyCheck -->|"Kakuena mikenji mipeta to"| ExtAudit["3. Lekela diumvuangana -> Enza mudimu wa muenji wa mudimu mu chrome://extensions -> Umanye ne umbusha bintu bibi"]
    WipePolicy --> ExtAudit
    OSClip --> ExtAudit
    ExtAudit --> DiskWipe["4. Kumbusha bipese bia bintu bidi bishala, bena mudimu ne tshilaminu tshia IndexedDB mu tshilaminu tshia malu a bena mudimu"]
    DiskWipe --> CookieRevoke["5. Ku tshiamu tshikezuke: Umbusha bionso bidi bienza mudimu (Google, Microsoft, GitHub, Banks) ne Tangila dianyisha dia Crypto"]

Mushindu kayi udi bintu bia pa buabi bia ku Enternete bilua bibi mu butuku bumue (ne mishindu 5 ya dibunda)¶

Bantu bapite pa 70 pa lukama badi bapeta disama dia tshiamu tshia mudimu tshibi kabavua banji kutua pa tshiamu tshia mudimu tshibi to: bavua bateke tshiamu tshia mudimu tshia pa tshibidilu, tshia mushinga mukole buludiludi ku Chrome Web Store, Microsoft Edge Add-ons Store, anyi Firefox Add-ons (AMO) ngondo anyi bidimu kumpala. Bena tshinyangu ba ku Enternete badi banyanga bintu ku diambuluisha dia mishindu ibidi ya difila dia bintu: 1. Dipeta dia bintu bia pa mutu / Dipeta dia makuta (muaba udi muena tshinyangu upesha muenji wa mudimu udi kayi ne bumfumu dolare 5000 to ne ku 50 000 bua kusumba bumfumu bua tshintu tshia pa mutu tshidi ne bantu 100 000, pashishe udi utuma tshiamu tshia mudimu tshidi katshiyi tshiumvuika tshidi ne bintu bibi bidi muena mudimu yonso udiku utangila nkayende); ne 2. Developer OAuth Phishing (muaba udi bena tshinyangu bashipa konte wa muenji wa tshiamu tshia Chrome Web Store, anu muvuabi bienzeke mu bilumbu binene bia difila dia bintu bivua binyanga biamu bia bungi bia mudimu ne bia bukubi).

Tshitupa 1: Mushindu wa kukontonona, kumanya, ne kumbusha bintu bibi bia mu Chrome, Edge, Brave, Firefox, ne Safari¶

Do not simply glance at the icons next to your address bar: malicious extensions deliberately hide their toolbar icon (Action button hidden) or masquerade using the exact icon and name of Google Docs Offline, Google Translate, uBlock Origin, or Adobe Acrobat.

Tshitupa 1: Tangila bintu biudi muteke ne wangate ID wa maleta 32¶

1. Disconnect your computer from Wi-Fi / Ethernet so no extension can transmit a final data payload or self-update while you inspect it.
2. Open your browser's internal extension management console by typing the exact URI into the address bar:
3. Google Chrome: chrome://extensions
4. Microsoft Edge: edge://extensions
5. Brave Browser: brave://extensions
6. Mozilla Firefox: about:addons (and also type about:debugging#/runtime/this-firefox to see temporary/hidden add-ons)
7. Apple Safari (macOS): Safari -> Settings (Cmd + ,) -> Extensions
8. Turn ON "Developer mode" (toggle switch in the top-right corner of Chrome, Edge, and Brave).
9. Turning on Developer mode reveals critical forensic details on every extension card:
10. ID: A unique 32-character lowercase string (such as cjpalhdlnbpafiamejdnhcphjbkeiagm).
11. Inspect views: service worker / background page: Shows whether the extension is actively running a background script right now.
12. Source: Installed by enterprise policy anyi Loaded from: C:\Users\... (Unpacked Extension): Unless you are a software developer who wrote the extension yourself, no legitimate consumer extension should ever say Loaded from: [Folder Path] (an Unpacked Extension). Malware authors sideload unpacked extensions from hidden AppData anyi ProgramData folders via shortcut modification (chrome.exe --load-extension="C:\...") to bypass the Chrome Web Store security scanner completely.
13. Check every extension against these Removal Criteria:
14. Click Details -> Permissions (Site access) on every single extension. Any extension that has On all sites (Read and change all your data on all websites) that is not a deeply trusted, verifiable open-source security tool (such as your primary password manager) should be removed immediately, or at minimum have its Site access restricted from On all sites to On click.
15. Click Remove on any PDF converter, free VPN, video/MP3 downloader, volume booster, custom cursor, dark-mode toggle, coupon finder, AI sidebar, or game extension you do not strictly need.

Step 2: Inspect the Extension's manifest.json and Live Network Traffic Before Removal (Forensic Triage)¶

If you need to know whether a suspicious extension actually stole your corporate passwords, session cookies, or cryptocurrency keys before you delete it, take two minutes to inspect its local source files on disk while your Wi-Fi is still disconnected: 1. Copy the 32-character ID shown on the extension card in chrome://extensions. 2. Navigate to your browser's local Extensions folder on disk (listed in the table in Step 4 below) and open the folder matching that 32-character ID. 3. Open the manifest.json file inside that folder using Windows Notepad or macOS TextEdit and inspect three fields: - "permissions" ne "host_permissions": Keba bukenji bua njiwu mikole bu mudi "cookies", "webRequest", "declarativeNetRequest", "clipboardRead", "clipboardWrite", "scripting", "debugger", "proxy", and "<all_urls>". Tshintu tshidi tshileja muditshi "Dark Mode Toggle" anyi "Volume Booster" tshidi tshilomba "cookies" ne "<all_urls>" is almost certainly harvesting login sessions. - "content_scripts": Ileja mishindu kayi ya JavaScript (content.js, inject.js) are injected into every webpage you visit, including banking and crypto wallet portals. - "background" ("service_worker"): Identifies the persistent background script (background.js anyi sw.js). Searching that JavaScript file in Notepad for strings like fetch(, XMLHttpRequest, WebSocket, navigator.clipboard, chrome.cookies.getAll, eth_sendTransaction, anyi atob( reveals the attacker's command-and-control (C2) domain and shows exactly what data was exfiltrated.

Step 3: Check Browser Shortcut Target Hijacking (--load-extension)¶

Even after you click Remove inside chrome://extensions, a common trojan technique modifies the desktop and taskbar shortcut icon you click to launch Chrome, Edge, or Brave so that it automatically reloads a hidden malicious unpacked extension every time you open the browser. - On Windows: 1. Right-click your Google Chrome / Microsoft Edge / Brave icon on your Desktop (and right-click the icon on your Taskbar -> right-click the browser name again -> click Properties). 2. Look at the Target: box under the Shortcut tab. 3. A clean Target box ends strictly with "chrome.exe" anyi "msedge.exe": - CLEAN: "C:\Program Files\Google\Chrome\Application\chrome.exe" - HIJACKED: "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\Public\Documents\ExtUpdater" https://search-hijack.com 4. Delete everything after chrome.exe" (or delete the shortcut entirely and pin a fresh shortcut directly from C:\Program Files\Google\Chrome\Application\chrome.exe).

Step 4: Delete Leftover Extension Files and Service Workers from Disk¶

Locate your browser's local profile directory and delete the subfolder matching the rogue extension's 32-character ID, plus purge registered service workers:

After deleting the extension folder, open chrome://serviceworker-internals (or edge://serviceworker-internals) mu tshiamu tshiebe tshia kutangila natshi bintu ne tuaku pa Unregister pa muena mudimu yonso udi utangila tshitupa tshidibu bumbushe anyi domaine ya push-notification idi kayiyi mimanyike.

Tshitupa 5: Kumbusha bukenji bua dimanyisha dia malu mabi, biamu bia dikebulula bidibu banyenge, ne malu mabi a proxy / DNS¶

Ma extension a bungi a adware ne a browser hijackers adi ashiya mateyi asatu nansha padibu bamane kujimija extension binary: 1. Kumbusha mamanyisha a pa lutanda lua Internet adi kaayi makane (ma antivirus a dishima): - Shi mamanyisha a dishima a McAfee, Norton, nansha a Windows Defender adi atungunuka ne kupatuka mu ditumba dia kuinshi dia dia balume dia tshibuelelu tshieba dîba dionso didi tshikebelu tshieba tshiunzulula, adi HTML5 Web Push Notifications afumina ku site wa tshinyangu uudi mupeshe bukenji bua kumanyisha ku mpukapuka. - Kukangula chrome://settings/content/notifications (anyi edge://settings/content/notifications / about:preferences#privacy -> Bukenji -> Mamanyisha mu Firefox). - Bala panshi ku liste wa "Allowed to send notifications", tuaku pa tutonyi tusatu tudi ku luseke lua domaine yonso udi kuyi mumanye anyi udi wela mpata, ne tuaku pa Kumbusha anyi Kukandika. 2. Kupingaja tshiamu tshia kukebela natshi bintu ne mabeji a ntuadijilu: - Kukangula chrome://settings/searchEngines (edge://settings/search) ne ujadike ne: tshiamu tshieba tshia kukeba natshi malu tshidi tshileja Google mulelela (google.com), DuckDuckGo, anyi Bing pamutu pa URL wa dishintulula dia bintu (search.yahoo.com/yhs/... anyi find-results.net). Butula mishindu yonso ya dikebulula idi kayiyi mimanyike mu liste. - Kukangula chrome://settings/onStartup (edge://settings/onStartup) ne funda "Kangula dibeji kampanda anyi tshisumbu tshia mabeji": umbusha URL yonso ya ntuadijilu idi kayiyi mimanyike idibu bele kudi adware. 3. Tangila ni Proxy wa tshiamu tshia mudimu anyi DNS mu bukubi (DoH) Malongolola: - Bimue bintu bibi ne bantu badi bateka programe ya adware badi balongolola PAC (Proxy Auto-Config) script anyi DNS-over-HTTPS (DoH) serveur bua bobu kutungunuka ne kuangata njila webe wa ku Enternete kunyima kua dilengeja dimane kujika. - Mu Chrome/Edge, ndaku ku chrome://settings/security -> ndaku too ne ku Use secure DNS ne ujadike ne: mmuteka kudi mufidi webe wa mudimu anyi kudi mufidi wa malu wa bantu bonso wa kueyemena (Cloudflare 1.1.1.1, Quad9 9.9.9.9, anyi Google Public DNS), ki URL wa pa buawu to. - Pashishe kangula chrome://settings/system -> tuaku pa Kangula mishindu ya proxy wa ordinatere webe, ne ujadike ne: "Use a setup script" ne "Use a proxy serveur" bionso bibidi mbijima OFF (pa kumbusha padibi bikengela kudi mfumuebe wa mudimu).

Tshitupa 2: Kumbusha mikenji ya dishima ya "Managed by your organization" (ExtensionInstallForcelist)¶

Shi udi pa ordinatere wa ku njibo (ki portable mufila kudi mfumuebe wa mudimu anyi kudi tulasa to) kadi kuyi mua kutua pa butone bua Umbusha pa tshiamu tshieba tshibi bualu tshidi ne tshimfuanyi tshikese tshia nzubu wa biro ku luseke luatshi ne Chrome/Edge udi uleja "Navigateur webe udi ulombodibua kudi bulongolodi buebe", adware mmubueje mikenji ya dishima ya Enterprise Group mu tshiamu tshiebe tshia mudimu.

Tshitupa 1: Tangila chrome://policy anyi edge://policy¶

Kututa chrome://policy (anyi edge://policy / about:policies mu Firefox) mu kazubu kebe ka adrese. - Keba mêna a mikenji bu mudi ExtensionInstallForcelist, ExtensionInstallAllowlist, ExtensionSettings, HomepageLocation, RestoreOnStartupURLs, anyi DefaultSearchProviderSearchURL. - Mulongo wa Mushinga udi ku luseke lua ExtensionInstallForcelist nealeje Extension ID wa maleta 32 wa extension wa malware ne URL wa dishintulula udiye ukoka.

Tshitupa 2: Kumbusha mikenji ya Rogue Browser pa Windows (Elevated Command Prompt)¶

Pa ordinatere webe wa Windows 10 anyi Windows 11 udi kayi ne bua kuikala ne mikenji ya tshikebelu tshia mudimu, tuaku pa Start Menu, funda cmd, tuaku ku dia balume pa Command Prompt, sungula Run as administrator, ne enza malu aa bua kumbusha Chrome, Edge, ne Brave policy hives ne kupingaja Group Policy:

reg delete "HKLM\SOFTWARE\Policies\Google\Chrome" /f
reg delete "HKCU\SOFTWARE\Policies\Google\Chrome" /f
reg delete "HKLM\SOFTWARE\Policies\Google\Update" /f
reg delete "HKCU\SOFTWARE\Policies\Google\Update" /f
reg delete "HKLM\SOFTWARE\WOW6432Node\Google\Enrollment" /f
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Edge" /f
reg delete "HKCU\SOFTWARE\Policies\Microsoft\Edge" /f
reg delete "HKLM\SOFTWARE\Policies\BraveSoftware\Brave" /f
reg delete "HKCU\SOFTWARE\Policies\BraveSoftware\Brave" /f
rmdir /s /q "%WinDir%\System32\GroupPolicy"
rmdir /s /q "%WinDir%\System32\GroupPolicyUsers"
gpupdate /force

Panyima pa wewe mumane kuenza mudimu ne mêyi aa, pingana ku chrome://policy (anyi edge://policy) ne tuaku pa butone bua Reload policies budi kuulu ku dia bakaji. Mikenji yonso ya mudimu mienzeja neyijimine diakamue, ne butone bua Kumbusha mu chrome://extensions neabulule.

Tshitupa 3: Kumbusha mikenji ya Rogue Browser ne mishindu ya dilongolola dia macOS¶

Pa macOS, bena tshinyangu ba tshiamu tshia mashinyi badi benza mudimu ne mikenji ya dishima ya mudimu ku diambuluisha dia mishindu ibidi: 1. MacOS Configuration Profiles (MDM profiles) udi muena mudimu mushimibue bua kuela ku diambuluisha dia tshiamu tshia dishima tshia Flash/video player, ne 2. Kulombola plist mikanda ya disungula.

1. Tangila ne umbusha malu mabi a macOS:
2. Kangula Apple Menu -> System Settings -> General -> Device Management (pa macOS Monterey/Big Sur wa kale, kangula System Preferences -> Profiles).
3. Shi udi pa tshiamu tshia Mac tshia pa nkayebe ne umona tshintu tshionso tshidi tshifunda muinshi mua Device Management/Profiles (tshidibu babikila misangu ya bungi ne: "Chrome Settings", "SearchConfig", "AdminPrefs", anyi "WeKnow"), tshisungule ne tuaku pa - (Remove) button at the bottom, then enter your Mac password to delete it.
4. Kujimija tshikebelu tshilombola plist Bintu bia ku macOS Terminal:
5. Kangula Terminal (Cmd + Space, kututa Terminal) ne wenza mudimu ne mêyi aa bua kumbusha malu adibu benzeja ku bukole plist mikanda ya mikenji ne kumbusha cfprefsd cache:

sudo rm -f /Library/Managed\ Preferences/com.google.Chrome.plist
sudo rm -f /Library/Managed\ Preferences/*/com.google.Chrome.plist
sudo rm -f /Library/Preferences/com.google.Chrome.plist
rm -f ~/Library/Preferences/com.google.Chrome.plist
sudo rm -f /Library/Managed\ Preferences/com.microsoft.Edge.plist
sudo rm -f /Library/Preferences/com.microsoft.Edge.plist
defaults delete com.google.Chrome ExtensionInstallForcelist 2>/dev/null
defaults delete com.google.Chrome HomepageLocation 2>/dev/null
sudo killall cfprefsd

Tuadija kabidi Chrome/Edge ne ujadike ku chrome://policy ne mikenji ya zero idi ishala mienza mudimu.

Tshitupa 3: Kujingulula ne kumbusha bena tshinyangu tshia OS-level Crypto Clipboard Hijackers ("Clippers")¶

Netuambe tshinyi wewe mumbushe tshintu tshionso tshia kubandila, mukanga tshikebelu tshiebe tshijima, ne mutete bua kukopa adrese wa tshibutshilu tshia makuta (0x... anyi bc1...) munda mua Windows Notepad anyi macOS TextEdit, ne adrese mufunda utshidi anu ushintuluka mu adrese wa tshibutshilu tshia muena tshinyangu?

That means an Operating System-level Clipper Malware binary (Laplas Clipper, ClipBanker, phemedrone, RedLine, anyi script wa Python/Node/AutoIt mubi) udi wenza mudimu kunyima kua tshiamu tshieba tshia mudimu ne udi ubikila Windows AddClipboardFormatListener / SetClipboardData API (or macOS NSPasteboard polling loop).

Step 1: Identify Which Process Currently Holds or Polls Your Clipboard¶

• Pa Windows (PowerShell Live Process & Startup Audit): Fungula PowerShell bu mulombodi ne wenze mudimu ne dîyi edi bua kuleja malu onso adi kaayi a mu Microsoft adi kaayi ne mikanda idi mua kufunda kudi muena mudimu (AppData, Temp, ProgramData, Users\Public) mudi bantu 99 pa lukama ba Clipper Trojans basombele:

Get-CimInstance Win32_Process | Where-Object {
    $_.ExecutablePath -match "AppData|Temp|ProgramData|Users\\Public"
} | Select-Object ProcessId, Name, ExecutablePath, CommandLine | Format-List

Tangila tshidi tshipatuka bua kumanya ni udi ne mpata .exe, pythonw.exe, wscript.exe, cscript.exe, powershell.exe, mshta.exe, anyi AutoIt3.exe malu adi enda ajika %AppData%\Roaming, %LocalAppData%\Temp, anyi C:\ProgramData. Tangila ProcessId (PID) ne ExecutablePath, kujikija mudimu ne Stop-Process -Id <PID> -Force, ne kumbusha binaire pa diske.

• Tangila miaba ya dilama dia Windows (Run Bifungu & Scheduled Tasks): Clippers udi upanduka ku reboots pa kusakidila Registry Run tshifungu, tshibangidilu .lnk mukanda mu shell:startup, anyi mudimu mulongolola. Enza bimanyinu bibidi ebi bia PowerShell bua kubileja:

Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run", "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
Get-ScheduledTask | Where-Object {$_.State -ne "Disabled" -and $_.Author -notmatch "Microsoft"} | Select-Object TaskName, TaskPath, State

Teleja Microsoft Sysinternals Autoruns (Autoruns64.exe) katshia learn.microsoft.com/en-us/sysinternals/downloads/autoruns, enza mudimu bu mulombodi, enza bua Malu adibu mua kuenza -> Malu adibu mua kuenza bua kukonkonona -> Kujadika bimanyinu bia kode + Tangila VirusTotal.com, ne kumbusha tshintu tshionso tshikunze/tshidi katshiyi tshifunda mu Logon, Scheduled Tasks, anyi WMI tabs.

• Pa macOS (LaunchAgents & Background Process Audit): Fungula Terminal ne tangila mudimu ne tshiamu tshionso LaunchAgents ne LaunchDaemons (mudi macOS clippers ne Atomic Stealer / Poseidon scripts ya ditantamena disokoka):

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons
ps aux | grep -E "osascript|python|node|curl|base64|NSPasteboard"

Tangila tshintu tshionso tshiudi kuyi mumanye .plist mukanda mu -/Library/LaunchAgents kuenza mudimu ne cat -/Library/LaunchAgents/<filename>.plist, upuekeshe ne launchctl unload -/Library/LaunchAgents/<filename>.plist, ne kumbusha bionso bibidi .plist ne binaire udi uleja.

Tshitupa 4: Diondopangana dia panyima pa disama (dimbusha dia cookies ya tshikondo tshiiba, bimanyinu bia OAuth, ne dianyisha dia Web3)¶

Kujimija tshintu tshibi tshia tshiamu tshia kutangila natshi bintu kudi kuimanyika mudimu wa tshikebelu tshia matuku atshilualua, kadi kakuena kunyangakaja cookies ya tshisangilu, meyi a tshisokomenu adibu balame, anyi mêyi a mu tshibutshilu adi tshiamu etshi tshikale tshiteka pa serveur wa muena tshinyangu patshivuatshi tshiteka to. Tuangate ne: tshitupa tshionso tshivua tshiunzulula ne mot de passe yonso uvuabu balame munda mua tshilaminu tshia mot de passe tshia mu tshiamu tshia kutangila natshi bintu mbinyanguke:

1. Kuenzeja "Kupatuka mu bisangilu bionso" pa konte yebe ya mushinga:
2. Kushintulula anu meyi a tshisokomenu kutu misangu mikuabu kulekela bimanyinu bia OAuth anyi bisangilu bia ku telefone anyi bia ku Enternete bikale ne mushinga too ne ku dîba dimue. Buela mu tshiamu tshikezuke ne tuaku pa Kupatuka mu bisangilu bionso / Kumbusha biamu bionso:
   • Google / Gmail: myaccount.google.com/device-activity -> sungula tshisangilu tshionso tshiudi kuyi mumanye anyi tshia pa mesa -> Patuka. Tangila kabidi myaccount.google.com/permissions bua kumbusha programe ya OAuth ya bantu bakuabu.
   • Microsoft / Outlook / 365: account.live.com/proofs/manage/additional -> tuaku pa Sign me out (udi usaka bantu bonso bua kupatuka mu biamu bionso bia mudimu mu mêba 24).
   • GitHub / GitLab / AWS / Cloud Consoles: Ndaku ku github.com/settings/sessions -> Umbusha bikondo bionso, ne ushintulule bimanyinu bionso bia muntu nkayende (PATs) anyi SSH keys.
   • Discord / Slack / Social Media: Umanye ne: malu mabi adi atangila anu Discord Local Storage tshimanyinu tshia bujadiki ne cookies ya Facebook Business Manager; shintulula mot de passe webe wa Discord (udi upingaja tshimanyinu tshieba tshia muena mudimu wa Discord) ne ujikije bikondo bionso bidi bienda mu Facebook/Instagram Security Settings.
3. Migrate Any Software Crypto Wallet (MetaMask, Phantom, Rabby, Keplr) Tshivua tshiteka mu tshikebelu tshimue:
4. Shi tshintu tshibi tshidi ne <all_urls> anyi scripting access, or if an OS-level infostealer ran on your PC, it may have read your encrypted vault file (ldb files in Local Extension Settings) and captured your wallet unlock password as you typed it.
5. Do not keep funds in that hot wallet seed phrase. Generate a brand-new wallet seed phrase on a clean device or Hardware Wallet (Ledger, Trezor, Keystone), transfer your remaining assets to the new wallet, and revoke dangling token approvals at revoke.cash following our cryptocurrency wallet drain ne seed phrase compromise guide.
6. Perform a Full Browser Reset:
7. Ndaku ku chrome://settings/reset (edge://settings/reset / about:support -> Refresh Firefox) and click Restore settings to their original defaults. This resets your startup page, new tab page, search engine, and pinned tabs, clears temporary cookies, and disables any remaining extensions.

Nkonko itubu bela misangu ya bungi¶

Bua tshinyi tshintu tshimvua muenze natshi mudimu bimpe munkatshi mua bidimu 2 tshiakalua logiciel mubi anyi adware?¶

Browser extensions update automatically and silently in the background without asking for your permission unless the new version requests a brand-new permission category. Cybercriminal groups and ad-fraud syndicates regularly contact solo developers of popular, legitimate extensions (such as PDF tools, volume boosters, screen recorders, or ad blockers) and offer them thousands of dollars to sell their Chrome Web Store developer account or transfer ownership of the extension. Once the buyer controls the listing, they push a silent version update containing cookie-stealing or affiliate-hijacking code that infects every existing user overnight.

Does Google's Manifest V3 update make Chrome and Edge extensions completely safe from malware?¶

No. While Manifest V3 significantly improves security by banning extensions from loading remotely hosted executable JavaScript code from external servers (forcing all code to be bundled inside the extension package submitted to the store), malicious extensions compiled under Manifest V3 can still abuse broad host permissions (On all sites), read DOM form inputs and keystrokes, hijack the clipboard via content scripts, steal cookies, and manipulate search results via declarativeNetRequest rules. Limiting extensions to only those you strictly trust and setting their Site Access permission to "On click" rather than "On all sites" remains essential.

How can I protect my cryptocurrency transfers from clipboard hijacker malware in the future?¶

First, never verify only the first 4 and last 4 characters of a pasted wallet address, because modern clipper malware uses pre-computed vanity address pools to pick an attacker address that shares the same starting and ending characters as your intended recipient; always check at least the first 6, middle 6, and last 6 characters. Second, use an offline Hardware Wallet with a physical screen (such as a Ledger, Trezor, or GridPlus) and verify the full recipient address on the hardware device's physical screen before pressing the physical confirmation button, and save frequently used recipient addresses inside your wallet's whitelisted Address Book rather than copying and pasting them from your clipboard.

Miaba mifumina¶

• Tshibambalu tshia bukubi bua ku Enternete ne tshia bintu bia mudimu (CISA, États-Unis) & Biro bia malu a makebulula bia mbulamatadi (FBI): Mibelu ya bukubi bua ku Enternete pa bidi bitangila Infostealer Malware, Session Cookie Hijacking, ne Malicious Browser Extensions.
• Tshilongelu tshia ditunga tshia mikenji ne bia mudimu (NIST, États-Unis): SP 800-83 Rev. 1, Mukanda wa dikuba ne dilama dia malu mabi a ordinatere ne a ordinatere.
• Google Chrome Enterprise & Chromium Security Team: Chrome Enterprise Policy List (ExtensionInstallForcelist), Manifest V3 Extension Security Architecture, and Remedying Unauthorized Policy Injection.
• Microsoft Security Response Center (MSRC) & Microsoft Defender Threat Intelligence: Kukonkonona ne kulongolola CrypToClipper / Clipboard Hijacker Malware ne Rogue Browser Policy Registry Persistence (HKLM\SOFTWARE\Policies\Microsoft\Edge).
• Tshibambalu tshia bukubi tshia ku Enternete tshia ditunga (NCSC, Royaume-Uni): Dilombola dia bukubi bua tshiamu: Dilombola dia malu a tshiamu tshia mudimu, Dilombola dia mikenji ya mudimu, ne Dikepesha buivi bua token.

Malu adi apetangana¶

• Dijimina dia tshibombi tshia makuta a tshiamu tshia mitaku, dinyanguka dia tshiambilu tshia ntete, ne dijimija dia dianyisha
• Diumusha dia bintu bibi, ransomware, ne spyware
• MFA phishing, adversary-in-the-middle (AiTM) bypass, ne session cookie theft
• Diandamuna dia dishipa dia mikenji, meyi a tshisokomenu adi mapatuke, ne dikanga dia mfranga
• Nomba ya njiwu bilondeshile ditunga