From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker

This report describes a coordinated campaign that distributes Rust-based clipboard hijackers via a WordPress phishing site and mirrored projects on GitHub and SourceForge, promoted through YouTube (AI-generated narrators), manipulated VirusTotal feedback, news posts, and forum ads; the malware achieves persistence on Windows and macOS, monitors and replaces cryptocurrency addresses from the clipboard using extensive regex-based lists, and has diverted funds to attacker-controlled wallets while the operator uses 'ghost networks' to fake legitimacy.