Clipper Malware Targets IBAN & Crypto Transactions

This report describes underground cybercriminal activity involving IBAN clipper malware sold as subscription services on forums; the malware monitors clipboard content, detects IBANs via regex, and replaces recipient IBANs with attacker-controlled accounts to divert SEPA transfers. The report also documents related clipper variants targeting cryptocurrency addresses and a leaked stealer (Stealerium), highlights delivery vectors (phishing, malicious URLs, bundled software), and includes proof‑of‑concept demonstrations and forum postings observed by Cyble Research Labs.