Clipboard hijacker malware n'igitero c'ubumara bw'aderesi: guhindura crypto wallet canke IBAN ku gushiramwo, kugenzura inyuguti zo hagati n'iza nyuma¶

Iyo ukopiye aderesi y'isakoshi y'amahera y'ibanga (BTC, ETH, USDT, SOL, TRX) canke inomero ya konti ya banki mpuzamakungu (IBAN / SWIFT / ABA) hanyuma ukande gutera (Ctrl+V canke Cmd+V), iterabwoba ribiri ritandukanye rishobora guhindura amahera yawe mu gacerere ku mugwi w'abagizi ba nabi: Umunyavyaha w'ibitabo ("Clipper") Malware yo mu karere ikora mu bubiko bwa mudasobwa yawe ihindura umwandiko uri mu bitabo vyawe vy'ibitabo mu masegonda makeyi 5, canke **Aderesi y'ubusa y'amateka yawe ihindura ubumara bwawe aderesi y’ikinyoma ihuye n’inyuguti 4 za mbere gushika kuri 6 be n’inyuguti 4 gushika kuri 6 za nyuma z’aho uja vy’ukuri. Iyi nkuru itanga intambwe zihuse zo gukuraho amafaranga y’ubuhinga bwa blockchain canke y’ubuhinga bwa none, kumenya no gukuraho porogarama mbi zigenzura clipboard zo mu karere, no kugenzura inyuguti zo hagati z’aderesi yose y’aho umuntu aja imbere yo gusinya ku gicapo c’amahera y’ibikoresho.

Ivyo ubikore ubu¶

1. Gerageza gusubirira Nonce ubwo nyene (Speed Up / Cancel) nimba amafaranga y'ibanga akiriko arategerezwa muri mempool. Fungurira igikapu cawe (MetaMask, Rabby, Ledger Live, Electrum, Sparrow) maze ugenzure nimba ivy'ugucuruza bikiri Bitegerejwe / Ntivyemejwe. Ku minyororo ya Ethereum na EVM, ubwo nyene ukande Gukuraho (canke wohereze 0 ETH gukoresha kuri aderesi yawe bwite ukoresheje iyo Custom Nonce nyene n’Igiciro ca Gaz y’Imbere kiruta 30 kw’ijana). Ku Bitcoin, shira mu ngiro Subiriza-N'Ikiciro (RBF) gusubiramwo kugira ngo ushire ivyo winjije mu gikapu cawe bwite imbere y'uko igice gikurikira gicukurwa.
2. Hamagara ikigo ca banki yawe kijejwe ubusuma bw’amatelefone ubwo nyene iyo umuntu IBAN, ABA, canke Sort Code yahinduwe ku gushiramwo. Niba porogaramu mbi ya clipboard yahinduye inomero ya konti ya banki yashizwe ku nzira yo mu rugo, SWIFT kwimurira, canke SEPA kwishura, hamagara umurongo w’ubuhendanyi wa banki yawe canke inomero y’ivyihutirwa yo mu karere kawe (911 muri Leta Zunze Ubumwe za Amerika na Canada, 112 mu Bumwe bw’Uburaya bwose, 999 mu Bwongereza) kugira ngo ubone inomero z’ubugizi bwa nabi za polisi; raba inomero z'ivyihutirwa ku bijanye n’ubucuti mpuzamakungu. Gusaba vuba SWIFT MT192 / SEPA SCT Recall kandi uvuge ukudahuza hagati y’Izina ry’Uwuronka Inyungu n’Iryasubiriwe na Clipper . IBAN.
3. Menya neza nimba uriko urashikirwa n'ubumara bwa Local Clipper canke ubumara bw'aderesi yo ku ruzitiro. Gufungura umuhinduzi w'inyandiko rusangi (Notepad kuri Windows canke TextEdit kuri macOS), kopa aderesi y'agasakoshi izwi canke urudodo rw'akarorero (0x71C...89A), hanyuma uyishire muri dosiye y’inyandiko. Iyo umwandiko washizweko uhindutse aderesi itandukanye, ubwo nyene ukanda Ctrl+V, igikoresho cawe carandujwe cane na Clipper Malware; uce uhagarika mudasobwa kuri Wi-Fi na Ethernet ubwo nyene. Niba umwandiko washizweko udahinduka muri Notepad, warakopiye Aderesi y'Ubusa buteye Ubumara uhereye ku rutonde rw'amateka y'ibikorwa vy'ubucuruzi vyawe.
4. Funya amabarabara y'ubucuruzi hagati maze ushiremwo Tether (USDT) canke Uruziga (USDC) amasezerano y'ubwenge asabwa ku rutonde rw'ibirabura. Iyo yibwe amafaranga y'ibice (USDT canke USDC) vyarungitswe ku gikapu c’ubumara canke c’impuzu y’impuzu ku Ethereum, Tron (TRC-20), canke Solana, ukurikirane Hash y’Ibikorwa (TXID) ku mugenzuzi w'ibarabara (Etherscan, Tronscan, Solscan) kandi ushikirize itike y’uguhagarika ivyihutirwa y’abajejwe gukurikiza amategeko kuri Tether (tether.to) canke Umuzingi (circle.com), zifise imfunguruzo z'amasezerano y'ubutegetsi (AddedBlackList / freeze) capable of freezing stolen USDT/USDC directly inside the attacker's wallet.
5. Evacuate remaining funds from the infected PC using a separate, clean device. Because Clipper Malware (Laplas Clipper, ClipBanker, Lumma, RedLine) is almost always bundled inside a broader credential and seed-phrase infostealer, assume every software wallet (MetaMask, Phantom, Exodus) and saved password on that computer is compromised. Do not type your seed phrase or private keys into the infected machine.

Diagnosing the attack: Local Clipper Malware vs. On-Chain Address Poisoning¶

Although both attacks result in your money arriving at an attacker's wallet instead of your intended recipient's address, their technical mechanics are completely different. You must identify which attack occurred within the first 60 seconds because Local Clipper Malware means your operating system is breached, whereas Address Poisoning occurs entirely on the public blockchain without any malware on your device.

1. How Local Clipboard Hijacker ("Clipper") Malware works¶

A Clipper (Trojan.Clipper, Cryxos, ClipBanker, Laplas) is a lightweight background process, malicious Chrome/Firefox browser extension, or Trojanized open-source package that registers a hook into the operating system's clipboard API (AddClipboardFormatListener kuri Windows canke NSPasteboard on macOS). * Real-time Regex pattern matching: Every time you press Ctrl+C (Copy), the malware inspects the copied string against Regular Expressions (Regex) looking for patterns that match a Bitcoin address (bc1q..., 1..., 3...), an Ethereum/EVM address (0x followed by 40 hexadecimal characters), a Tron TRC-20 address (T followed by 33 characters), a Solana address, or a European/UK IBAN (DE89..., GB29...). * Instantaneous substitution: Within 2 to 5 milliseconds, before your fingers move from Ctrl+C ku Ctrl+V, the malware overwrites your system clipboard buffer with an attacker-owned address. Advanced services like Laplas Clipper even generate a real-time vanity address on the fly from a massive pre-computed database of millions of attacker addresses so that the first 3 to 4 characters and last 3 to 4 characters of the substituted clipboard address match what you just copied.

2. How On-Chain Vanity Address Poisoning works (Zero Malware)¶

In an Address Poisoning attack, your computer, phone, and wallet are not hacked. Instead, blockchain threat actors run automated bots that monitor every public USDT, USDC, ETH, TRX, na WBTC transfer on Ethereum, Tron, Arbitrum, BSC, and Solana. * Igikoresho c'Imbere/Inyuma y'Ubusa: Igihe wohereje ukwimurirwa kwemewe (mbere n'ukwimurirwa kw'ikigeragezo c'imyimenyerezo y'amasezerano y'ubwenge y' $10) kuri aderesi nyayo y'uwakira, nk'akarorero: * Aderesi nyayo: 0x89205A3A3b2A69De6Dbf7f01ED13B2108B2c43e7 * Uwo muterabwoba akoresha amatsinda ya GPU kugira ngo akoreshe aderesi y’agasakoshi k’ibinyoma ifise inyuguti 5 za mbere (0x89205...) n'inyuguti 5 za nyuma (...c43e7) zisa 100 kw'ijana n'aderesi y'uwuguhaye vy'ukuri, mu gihe inyuguti 30 zo hagati zitandukanye rwose: * Aderesi isa n'iy'ubumara: 0x89205f91c48012b3847109ab84910283749c43e7 * Guhumanya amateka yawe y'ibikorwa (Zero-Value canke Fake Token Guhenda): Kubera ko ERC-20 na TRC-20 amasezerano y’ubwenge (transferFrom) allow anyone to emit a 0 USDT kwimurira ibintu mu gikapu cawe ata rufunguzo rwawe rw'ibanga (canke kohereza $0.0001 "dust" or a counterfeit unicode-spoofed USDТ token), the attacker inserts a fake transaction into your wallet's public transaction log so that their poisoned lookalike address sits at the very top of your "Recent Transactions" list. * Umutego wo guca UI: Kubera ko amasakoshi y'amatelefone ngendanwa n'ay'umucukumbuzi (MetaMask, Trust Wallet, Ledger Live, TronLink, Etherscan) truncate long 42-character addresses on screen as 0x89205...c43e7 to save space, both the real address and the poisoned address look visually identical in your transaction history. Next week, when you go to send the real $50,000 kwimurira no gukopa n'ubunebwe aderesi iri muri "transaction ya nyuma" yawe bwite mu mateka y'ipoke yawe aho gukopa igitabu cawe c'amaderesi, ukopa aderesi y'umuterabwoba yateye ubumara. * Rema2 Amasezerano y'Ubwenge Imbere y'Ibara: Mu bitero biteye imbere vyerekeye amatunga y'agaciro kanini, abatera bakoresha EVM CREATE2 opcode kugira ngo ukoreshe amamiliyoni y'amaderesi y'amasezerano y'ubwenge afise inyuguti 6 zihuye n'inyuguti 6 zihuye (12 matching hex characters total). When a victim sends funds to the dormant address, the attacker deploys a sweeper contract at that exact CREATE2 address to drain the funds automatically.

Emergency workflow: triaging a swapped wallet or IBAN transfer¶

Follow this decision tree immediately after discovering that a pasted address did not match your intended destination.

flowchart TD
    A["Discovered Wrong Crypto Address or IBAN After Pasting"] --> B{"Was the Transaction Already Broadcast / Sent?"}
    B -- "Oya (Yafashwe Imbere yo Gusinya)" --> C["Igerageza ry'urubaho mu gitabu c'inyandiko: Kopa aderesi nyayo hanyuma uyishireko"]
    B -- "Ego (Yaramaze gutumwa)" --> D{"Is It Crypto in Mempool, Confirmed Crypto, or Bank IBAN?"}
    C --> E{"Did Pasted Text Change in Notepad?"}
    E -- "Ego: Porogaramu mbi yo mu karere" --> F["Disconnect Internet Immediately; Scan Services/Extensions/Tasks"]
    E -- "No: On-Chain Address Poisoning" --> G["Delete Poisoned Contact; Whitelist Real Address in Hardware Wallet"]
    D -- "Crypto Still Pending in Mempool" --> H["Broadcast Nonce Cancel (EVM +30% Gas) or Bitcoin RBF Immediately"]
    D -- "Confirmed Crypto On-Chain" --> I["Gukurikirana TXID: Dosiye y'Ivyihutirwa Ikonja n'Umugozi (USDT) / Uruziga (USDC) / CEX"]
    D -- "Bank IBAN / Wire Transfer" --> J["Call Bank Fraud Desk: Demand SWIFT MT192 / SEPA Recall + Cite Name Mismatch"]

Comparison of clipboard hijacking and address poisoning vectors¶

Use this reference table to identify how the address swap occurred and what forensic artifacts exist on your system or blockchain explorer.

Step-by-step emergency actions if funds were just sent to the wrong address¶

If you pressed "Send" or signed the transaction before noticing that the middle characters of the address belonged to a Clipper or Address Poisoner, execute these steps immediately.

1. Canceling an unconfirmed cryptocurrency transaction in the mempool (First 10 to 60 seconds)¶

If the blockchain network is congested or you set a low gas/satoshi fee, your transaction may still be sitting in the public mempool waiting to be included in a block: * On Ethereum, Arbitrum, Polygon, Optimism, Base, and BSC (EVM Iminyororo): 1. Yugurutse MetaMask, Rabby, canke Trust Wallet and look at the Activity tab. If the transaction says Pending, click the Cancel button immediately and select Aggressive / High Gas Fee. 2. Manual Nonce Overwrite (More Reliable): Enable Customize transaction nonce in your wallet's Advanced Settings. Look up your pending transaction on Etherscan to find its exact Nonce number (for example, Nonce: 42). Immediately initiate a new transaction sending 0 ETH to your own wallet address, manually enter 42 in the Custom Nonce field, and set the Max Priority Fee (Gwei) at least 30% to 50% higher than the stuck transaction. Miners/validators will process your higher-fee 0 ETH gucuruza imbere, gukuraho ukwoherezwa nabi na Nonce 42. * Kuri Bitcoin (BTC): 1. Amasakoshi menshi yo muri iki gihe (Electrum, Sparrow, Ledger Live, BlueWallet) ushoboze Guhitamwo Gusubirira-N'Amafaranga (BIP-125 RBF) ku mburabuzi. 2. Fyonda iburyo ku giciro gisohotse kitaremejwe mu mateka y'ipoke yawe hanyuma uhitemwo Gusabira Igiciro (Double-Spend to Self) canke Igiciro c'Iterambere / Guhindura Igisubizo, gushinga igiciro c'amahera kinini cane (sat/vB yasuzumwe ku mempool.space) rero abacukuzi bemeza ko igikorwa co gusubirira bagasubira kuri aderesi yawe bwite y’ihinduka.

2. Gukonja vyibwe USDT (Umugozi) canke USDC (Umuzingi) biciye ku rutonde rw'amasezerano y'ubwenge¶

Udakunze Bitcoin canke Ethereum, amafaranga abiri manini manini y’amadolari y’Amerika, Tether (USDT) na Umuzingi (USDC), birimwo ibikorwa vy'ubutegetsi bihurikiye hamwe (blacklist, freeze, destroyBlackFunds) yanditswe ata guca ku ruhande mu masezerano yabo y’ubwenge y’ikimenyetso ku Ethereum (ERC-20), Tironi (TRC-20), Solana, Polygone, n’Igicucu. 1. Yugurutse Etherscan.io canke Tronscan.org kandi ushireko Hash yawe y'Ibikorwa (TXID). Suzuma nimba ivyo vyibwe USDT canke USDC ni akicaye imbere mu gikapu c’ubusa/clipper c’umuterabwoba canke igikapu c’umuhuza. Aderesi abatera ubumara kenshi basiga bibwe USDT mu aderesi y’ubusa amasaha canke imisi imbere y’uko uyihindura biciye ku nzira zitandukanye (DEXs) canke ibiraro vy’uruzitiro rw’umusaraba. 2. Ubwo nyene ushireho raporo y’ivyihutirwa kuri FBI IC3 (ic3.gov) n’abajejwe gukurikiza amategeko bo mu karere, kandi icarimwe uhamagare Ishirahamwe ry’Ukurikiza Amategeko / Infashanyo y’Abajejwe Gukurikiza Amategeko (tether.to/en/contact-us) canke Ibisabwa vyo gukurikiza amategeko n’ivyo nyavyo: * Aderesi y'isakoshi y'uwagirizwa * Aderesi y'aho umuterabwoba aja ifise ubu USDT/USDC ingano * Hash y'ubucuruzi (TXID) n'ikidodo c'isaha 3. Kandi umenyeshe ubusuma icarimwe ku nzira z’ubuhinga bwo gutanga inyishu ku bibazo nk’i Chainalysis, TRM Labs (Chainabuse.com), IKIMENYETSO 911 (Security Alliance ivyihutirwa Telegaramu bot @seal_911_bot ku bijanye na acute crypto hacks), n’amabiro y’ukubahiriza amategeko y’ubucuruzi bwose buhurikiye hamwe (Binance, Coinbase, OKX, Kraken, Bybit, FixedFloat, ChangeNOW) iyo uwuteye arungitse ayo mahera muri aderesi y’amahera yo guhindura.

3. Kwibuka umurongo wa banki wahinduwe na Clipper canke . IBAN guhererekanya¶

When Clipper malware targets business or personal banking users, it watches for copied IBAN strings (such as copying an IBAN from a supplier's PDF invoice in Adobe Reader and pasting it into an online banking portal) and swaps the IBAN with a money-mule account while leaving the Beneficiary Name untouched. * Invoke Verification of Payee (VoP / Confirmation of Payee) n’Amategeko y’Ukudahuza Izina: Hamagara igice c’ubuhendanyi bw’amatelefone ca banki yawe ubwo nyene. Sigura ko Clipper Malware yahinduye ivyo vyashizweko IBAN nimero kuri mudasobwa yawe kandi ko Izina rya Konti y’Uwuronka Inyungu ku rutonde rw’ugutanga inyungu ridahuye n’uwufise iyo nkuru yasubirijwe IBAN. * Mu mategeko y'Ubumwe bw'Uburaya yerekeye kwishura vuba (EU Regulation 2024/886) n’Ubwongereza Kwemeza Uwuzohembwa (CoP) inzego: Abatanga ubufasha bwo kwishura basabwa kugenzura ko IBAN na Izina ry'Uwuzoronka inyungu bihuye imbere y'uko bishirwa mu ngiro, kandi bitegerezwa gutanga SEPA Credit Transfer (SCT) Recall (camt.056) ku Buhendanyi mu idirisha ry’ugukuraho amafaranga hagati y’amabanki. * Kuzigama EIP-55 Checksum na Mod-97 IBAN Ivyemezo: Inyandiko nyayo IBAN ivyo vyari imbere mu giciro cawe c'umwimerere ca PDF n'ivyo IBAN vyoherezwa mu gitabu cawe c’igenzura ry’amabanki yo kuri Internet. Kubera IBAN imirongo irimwo imibare 2 ISO 7064 Mod-97-10 igenzura inyuma y'itegeko ry'igihugu (nk'akarorero, GB29 canke DE89), ikosa ry’umuntu ryo kwandika hafi ryose rinanirwa kwemeza imibare Mod-97 y’urubuga rwa banki ubwo nyene. Kugaragaza ko ikinyoma . IBAN yari afise umubare w’isuzuma ry’imibare ry’i Mod-97 ryemeza abatohoji b’ubuhendanyi bo muri banki yawe ko Clipper yikora yasubiriye urudodo rwose rwa konti aho gukoresha ikosa ryo gukanda urufunguzo.

Hunting and eradicating Local Clipper Malware (Windows, macOS, and Browsers)¶

Niba ikigeragezo ca Notepad yawe cerekanye ko clipboard yawe iriko irahindura neza amaderesi y’ipoke canke IBAN imibare, imashini yawe iriko irakoresha umuzigo w'inyungu wa Clipper. Kurikiza izi ntambwe utari mu murongo kugira ngo uyitandukane kandi uyikureho.

Phase 1: Check whether the Clipper lives inside your Web Browser Extensions¶

Imbere yo kwimba mu madosiye ya sisitemu, menya nimba umucukumbuzi w'ubuhendanyi ariwe akora: 1. Yugurutse Notepad.exe (Windows) or TextEdit (macOS) n'umucukumbuzi wawe w'urubuga ufunze burundu (genzura biciye ku Mucungerezi w'Ibikorwa Ctrl+Shift+Esc ko ata n'inyuma chrome.exe canke msedge.exe imigenderanire iriko iragenda). 2. Type a fake Ethereum address (0x1111222233334444555566667777888899990000) in Notepad, highlight it, press Ctrl+C, genda ku murongo mushasha, hanyuma ukande Ctrl+V. 3. Nimba aderesi ITAHINDUKA muri Notepad iyo umucukumbuzi yugaye, ariko IHINDUKA iyo ukopa kuri Chrome/Edge/Brave: Ufise umucukumbuzi w'ububisha (Malicious Clipper Extension). * Open your browser, type chrome://extensions (or edge://extensions / about:addons), and remove every unrecognized extension, especially fake ad blockers, PDF converters, dark-mode toggles, volume boosters, or fake Ledger/Uniswap/MetaMask helper extensions. * Reset browser sync at chrome.google.com/sync so Google does not automatically reinstall the malicious extension when you sign back in.

Phase 2: Identifying and killing OS-level Clipper processes in Safe Mode¶

If the address changes even inside Notepad with all browsers closed, you have an operating-system-level Clipper (ClipBanker, Laplas, Phemedrone, RedLine).

On Windows 10 and Windows 11¶

1. Disconnect from Wi-Fi and unplug Ethernet immediately.
2. Open Task Manager (Ctrl + Shift + Esc), click the Startup Apps tab, and disable any unfamiliar program (Clippers frequently disguise themselves as Realtek HD Audio Helper, Windows Updater, Java Update Scheduler, canke OneDrive Sync Host located inside AppData\Roaming\ instead of C:\Windows\System32\).
3. Open Task Scheduler (Win + R -> taskschd.msc). Suzuma igikorwa cose kiri mu Isoko ry'Igikorwa. Clippers zikomeza cane mu kurema igikorwa gitegekanijwe gikora buri munota 1 canke ku kwinjira kw'ukoresha, gusaba itegeko rya PowerShell ryihishijwe, .vbs inyandiko, AutoIt3.exe inyandiko, canke .exe ibitswe imbere:
4. C:\Users\<Username>\AppData\Roaming\
5. C:\Users\<Username>\AppData\Local\Temp\
6. C:\ProgramData\
7. Gucapura Win + R, ubwoko regedit, maze usuzume imfunguruzo zine z'intango za Run aho Clippers yiyandikisha kugira ngo itanguze igihe itanguye:
8. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
9. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
10. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
11. HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run

On macOS (NSPasteboard Abasuma: Atomic Stealer AMOS, Poseidon)¶

1. Disconnect from Wi-Fi.
2. Open Activity Monitor and search for unsigned processes or concealed Python/osascript scripts monitoring NSPasteboard.
3. Gucapura Cmd + Shift + G in Finder and check /Library/LaunchAgents/, /Library/LaunchDaemons/, na /Users/<YourUsername>/Library/LaunchAgents/ kubera umunyaruyeri .plist persistence files.

Hardware wallet defense: how to make Clipper and Poisoning attacks impossible¶

Even if your computer is infected with the most advanced Clipper malware on earth, or your transaction history is flooded with hundreds of poisoned vanity addresses, neither attack can steal your funds if you follow a strict Hardware Wallet (Ledger, Trezor, Keystone, Coldcard, GridPlus) physical screen verification protocol:

1. The "Middle-8 + Start-4 + End-4" Character Verification Rule: Never look at your computer monitor to verify an address, because a malicious browser extension can display the real address on your PC screen while sending the attacker's address to your wallet in the background. Instead, look directly at the physical OLED/E-Ink screen of your hardware wallet and compare it against a second, independent communication channel (such as a photo of the recipient's QR code on your smartphone or a verified voice readback of the middle characters):

0x 8920 [5A3A3b2A69De6Dbf7f01ED13B2108B] 2c43e7
   ====              ==========            ======
  Start-4          Verify Middle-10        End-6

1. Never copy an address from your "Recent Transactions" or Block Explorer history: Treat your wallet's transaction history (Activity tab in MetaMask, Ledger Live, Trust Wallet, or Etherscan) as untrusted public graffiti. Anyone on earth can inject fake rows into your public transaction history. Instead:
2. Save every recurring counterparty, exchange deposit address, and cold storage wallet inside your wallet's native Address Book / Whitelist Contacts (Settings -> Contacts mu MetaMask/Rabbi) n'ikimenyetso c'umuntu gitomoye ("My Coinbase USDC Deposit").
3. Once an address is saved in your Address Book, modern wallets replace the truncated 0x1234...5678 hex string with the contact's saved name badge across the interface. If a transaction in your history shows raw hex characters instead of your saved contact badge, you know immediately it is a poisoned imposter address.
4. Switch to a security-focused wallet client (Rabby, Frame, canke Ledger Clear Signing) with Poisoning Detection: Wallets like Rabby Wallet and MetaMask Blockaid security alerts automatically flag first-time transfers to an address that has never received funds from you before, warn you if an address visually mimics a previous contact (Similarity Warning), and hide 0-value spoofed token transfers from your main activity feed.

Urutonde rw'ivyo gutorera umuti inyuma y'ivyabaye¶

• Ikuraho itunga rya crypto ryasigaye mu mbuto nshasha y’ibikoresho: Ukoresheje telefone ngendanwa isukuye canke mudasobwa idashobora guhindurwa, ushiremwo ijambo rishasha ry’imbuto ry’amajambo 24 ku mbuto y’ibikoresho maze ushire ibimenyetso vyose bisigaye, NFTs, n’itunga rya gazi ry’imvukira mu gikoresho cose c’ubuhinga (MetaMask, Phantom, Trust Wallet, Exodus) yariho kuri mudasobwa yari yandujwe na Clipper.
• Gukuraho ivyemezo vy'ibimenyetso vya ERC-20 / TRC-20: Koresha revoke.cash (kuva ku gikoresho gisukuye) kugira ngo ukureho amafaranga yose atagira aho agarukira y’ugukoresha amafaranga ajanye n’amasakoshi ashushe yahungabanijwe.
• Kora igikorwa co gusubira gushiramwo OS isukuye biciye kuri USB nimba Local Clipper Malware yemejwe: Gusubiza inyuma inyandiko z’umuntu ku giti ciwe gusa no guhanagura ibice vyose vya disiki ukoresheje igikoresho gisukuye co gushiramwo Windows/macOS USB cakozwe kuri mudasobwa itandukanye (raba ivyacu Ukwagura umucukumbuzi w'ububisha n'ubuyobozi bwo gukuraho abasuma).
• Hindura amajambobanga yose yabitswe na mucukumbuzi maze ukureho ibihe bikora: Hindura amajambobanga y'imeli, banki, n'uguhanahana amakuru (Coinbase, Binance, Kraken), hanyuma usohoke mu biganiro vyose bikora.
• Dosiye yemewe y'abajejwe gukurikiza amategeko n'amakuru y'ubuhinga bwa blockchain:
• Leta Zunze Ubumwe za Amerika: Gutanga FBI IC3 (ic3.gov) raporo irimwo Hash nyayo y'Ibikorwa (TXID), aderesi y’isakoshi yawe, n’aderesi y’isakoshi y’umuterabwoba yitwa Clipper/Poisoned.
• Ubwongereza: Raporo ku Ubuhendanyi bw'Ibikorwa (actionfraud.police.uk).
• Ubumwe bw'Uburaya / Isi yose: Raporo biciye ku Imbuga z'igihugu z'ubugizi bwa nabi zo kuri internet za Europol, Chainabuse (chainabuse.com), na Etherscan / Tronscan "Aderesi y'Iraporo/Ibendera" rero aderesi y'umuterabwoba igaragara n'umutuku Fake_Phishing / Address Poisoning ibendera ry’imburi ku bazoshikirwa n’ivyago.

Ibibazo bikunda kubazwa¶

Ni gute umubeshi yatumye Etherscan canke Tronscan yerekana . $0 USDT transfer iva mu sakoshi yanje (From: My Wallet -> To: Scammer Wallet) nimba badafise urufunguzo rwanje rw’ibanga canke ijambo ry’imbuto?¶

Ivyo ni ibimenyetso vy'ingene **ERC-20 na TRC-20 amasezerano y'ubwenge** (`transferFrom` igikorwa) vyanditswe kuri Ethereum, Tron, na BSC. Iyo uwundi muntu ahamagaye . `transferFrom(Sender, Recipient, Amount)`, amasezerano y’ubwenge asuzuma nimba uwuhamagara afise amahera yemerewe (`approve`) kubera ivyo `Amount`. Kuko amahera yawe y’imbere ku muntu utazi ni . `0`, guhamagara `transferFrom(Your_Wallet, Scammer_Vanity_Wallet, 0)` bisaba ingurane y’ `0 <= 0`, isuzuma ku **Ukuri** kandi ikaroranirwa ataco ikeneye umukono wawe canke urufunguzo rw'ibanga. Igikapu cawe ntikigeze gifatwa; uwo muterabwoba yarishe gusa amasenti makeyi muri gaze kugira ngo amasezerano ya USDT asohore abantu bose . `Transfer` Igitabo c'ivyabaye kigaragaza aderesi yawe muri `From` column kugira ngo aderesi yabo isa n'iyo iboneke mu mateka y'isohoka ry'isakoshi yawe.

Ni kuki uwo mubeshi yanyoherereje amafaranga y’ibinyoma y’ 50,000 USDT ubwo nyene inyuma y'aho nrungikiye $10 test transaction ku mugenzi wanje?¶

Abakoresha crypto bazi utuntu n’utundi kenshi bararungika agace gatoyi . `$10` mbere ugerageze amafaranga, ugenzure ko umugenzi wabo yayaronse, hanyuma winjire mu gice ca "Ibikorwa biherutse" co mu sakoshi yabo kugira ngo ukope aderesi y'aho umugenzi wabo aja `$50,000` kwimurira. Aderesi ubumara bots cane cane kuraba ku bito `$1 to $100` kwimurirwa. Mu masegonda 10 y’ivyo `$10` test transfer confirming on-chain, bot y’umuterabwoba itanga aderesi y’ubusa ihuye n’inyuguti 5 za mbere n’iza nyuma z’aderesi y’umugenzi wawe maze igatangaza ikimenyetso c’ikinyoma kiva mu gikapu cawe kija kuri aderesi yabo y’ubusa kugira ngo **aderesi yabo y’ubumara yicare umurongo umwe hejuru y’urutonde rw’ibikorwa vyawe vy’ubu kuruta `$10` kwimurira ikigeragezo**.

Mbega porogaramu mbi ya Clipper yoshobora kwanduza iPhone (iOS) canke telefone ya Android, canke vyoba bikora kuri mudasobwa za Windows na Mac gusa?¶

Naho abateze amatwi ivy’inyuma vy’inyuma ari bo bakunda gukoreshwa cane kuri Windows na macOS, ibikoresho vy’amaboko na vyo nyene birashirwako umutima. Guhera muri **iOS 14+** na **Android 12+**, iyo sisitemu yerekana ibendera ry’umukate riboneka hejuru y’ibarabara (`"App pasted from Chrome"`) igihe cose porogarama isoma urupapuro rwawe, kandi igahagarika porogaramu zo mu nyuma gusoma canke kwandika hejuru y’urubaho mu gacerere ataco zishimikiyeko imbere. Ariko rero, porogarama z’amahera y’ibinyoma (`fake Ledger Live`, `fake Trust Wallet`, canke Android ishizwe ku ruhande `.apk` Abatiroyani nka `SharkBot` na `Xenomorph`) n'ama klavye y'amatelefone ngendanwa ashobora gufata no guhindura vyashizweko `IBAN` na crypto amaderesi mu gihe app yuguruye ku rubuga.

Nimba narungitse ku mpanuka $25,000 mu USDT ku aderesi irimwo ubumara, hari amahirwe ko uwo mutera azovugana n'abandi kugaruka "white-hat bounty" iyo mbarungikiye ubutumwa bwo ku ruzitiro (IDM)?¶

Mu bihe bidasanzwe cane, bikomeye cane birimwo amamiliyoni y’amadolari y’ibintu bishobora gukurikirana, igitutu c’abajejwe gukurikiza amategeko kifatanijwe n’ubutumwa bwo kwinjiza amakuru (`UTF-8 hex message` yoherejwe mu giciro gitoyi ca ETH ku aderesi y’uwateye itanga ubuntu bw’ibice 10 gushika ku 20 kw’ijana canke imburi y’uko Tether izohagarara vuba be n’ugushirwa ahabona kwa CEX KYC) vyatumye habaho inyungu zimwe zimwe. Ariko rero, **ntiwigere wishura uwundi muntu uwo ari we wese "umunyaruyeri wo gusubiza amafaranga" canke amahera y'imbere**, kandi ushire imbere kuronka **Tether (`USDT`) canke Uruziga (`USDC`) kugira ngo ushire urutonde rw’ibara ry’agahama kandi ushire umuzigo w’amasezerano y’ubwenge mbere**. Igihe Tether yariko arakonja ivyo yibwe . `USDT` imbere muri aderesi y’uwutera, uwutera ntashobora kwigera akoresha canke ngo yimure ivyo bimenyetso, kandi Tether arashobora guturira ivyo bimenyetso vyakonje maze agasubira kubisohora (`re-mint`) bakabisubiza ku wagirizwa ivyaha yagenzuwe iyo aronse itegeko ry’abajejwe gukurikiza amategeko canke ry’urukiko ry’ukuri.

Inyobora zifitaniye isano¶

• Clipper malware n'ubumara bw'aderesi y'ubusa mu crypto no mu banki IBAN
• Ukwagura umucukumbuzi w'ububisha, abasuma b'ibitabo, n'ugukuraho porogaramu zo kwamamaza
• Cryptocurrency igikapu c'amazi n'imbuto y'amajambo yo gusenyera ku mugozi umwe
• CAPTCHA y'ibinyoma Kanda gukosora PowerShell Win+R porogaramu mbi y'ububiko bw'amakuru n'ugusubizaho amakuru ya Lumma
• Corporate business email compromise (BEC) and wire fraud recall
• Inomero z'ivyihutirwa hakurikijwe igihugu

Amasoko n'ubuyobozi buzwi¶

• Federal Bureau of Investigation (FBI) Ikigo kijejwe gutanga ikirego c’ubugizi bwa nabi kuri Internet (IC3) (Leta Zunze Ubumwe za Amerika): Amatangazo y'Igihugu ku bijanye n'Ubumara bw'Aderesi y'Ubusa n'Ivy'Ubumara bw'Ibinyabuzima/Ivy'Ibinyabuzima.
• Ibikorwa vya Tether (tether.to) & Uruziga rw'Ivy'Imari ya Internet (circle.com): Ivy'ugukurikiza amategeko bihagaritswe, Urutonde rw'Ibirabura (AddedBlackList), n’Uburyo bwo Gusubiza Itunga ryibwe . USDT na USDC.
• Inama y'Uburaya y'Ivyishurwa (EPC) & Ubumwe bw'Uburayi (Regulation (EU) 2024/886): Ukwimurira inguzanyo muri SEPA (SCT) Kwibuka Uburyo bwo Guhenda no Kugenzura Uwuhembwa (VoP / IBAN-Izina Suzuma) Ivyagezwe.
• Ikigo c'igihugu kijejwe umutekano wo kuri Internet (NCSC) (Ubwongereza): Gugabanya ubusuma, uguhungabanya ubuhinga bwo kwagura umucukumbuzi, n’ubuhendanyi bwo guhindura inzira y’amahera.
• MITRE ATT&CK® Inzego: Ubuhinga T1115 (Ikwegeranya amakuru yo mu rupapuro rwo gufata amakuru no kuyakoresha).