Operation DualScript Bypasses Defenses to Hijack Crypto and Cash

Operation DualScript is a sophisticated, multi-stage in-memory malware campaign that establishes persistence via Windows Scheduled Tasks to run two parallel chains: a PowerShell-based clipboard hijacker that replaces copied cryptocurrency addresses and a RetroRAT implant providing keystroke capture and remote control; the campaign targets U.S. cryptocurrency and banking services, evades detection through living-off-the-land techniques and sandbox checks, and uses externally hosted payloads and C2 infrastructure for real-time updates.