The Fake “RedLine”: Imposter Malware Hijacks Crypto Wallets on Discord

CloudSEK STRIKE uncovered "RedLineCyber," a cybercrime campaign posing as an affiliate of the RedLine infostealer family to distribute a stealthy Python clipboard hijacker via private Discord communities; the malware monitors the Windows clipboard and replaces cryptocurrency addresses (Bitcoin, Ethereum, Solana, Dogecoin, Litecoin, Tron) with attacker-controlled addresses, enabling silent theft from streamers and community members through prolonged social engineering.