Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments

Check Point Research identified a coordinated campaign that distributes a Rust-based cryptocurrency clipboard hijacker (clipper) for Windows and macOS, using paid/promoted news posts, GitHub/SourceForge projects, a dedicated WordPress phishing page, a YouTube channel, and press-release syndication to build fake reputation. The actor employs "Ghost Networks" and coordinated upvotes/comments on platforms like VirusTotal, inflated download counts and positive reviews to lull victims into trusting and downloading the malicious tools, which replace matched cryptocurrency wallet addresses with attacker-controlled addresses to steal funds.