Keona Clipper Leverages Telegram for Anonymity

This report analyzes the Keona Clipper, a .NET-based clipboard hijacker sold via a Telegram-wrapped bot that intercepts copied cryptocurrency wallet addresses (BTC, ETH, LTC, XMR, etc.) and replaces them with attacker-controlled addresses; the analysis covers sample hashes, obfuscation and persistence techniques, Telegram C2 usage, targeted regexes for many coin types, observed transaction evidence, recommended mitigations, MITRE ATT&CK mappings, and multiple IoCs.