From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker
Brief
Key Points
The threat actor uses multiple channels to promote and distribute a Rust clipboard hijacker, starting with a dedicated phishing page as the central hub and extending to GitHub and SourceForge projects promoted by fake accounts. A dedicated YouTube channel, using AI‑generated narrators, suspicious view spikes, and highly positive (likely coordinated) comments, further reinforces the illusion of popularity and trustworthiness.
In addition, the threat actor’s tools were also promoted through posts on legitimate news websites. These articles appear to be either paid/promoted posts or content published via compromised news outlets , giving the malware extra legitimacy by placing it alongside trusted news content.
The same illusion mechanism extends to VirusTotal , where some samples from this campaign receive benign votes and “safe” comments.
