First Android Clipboard Hijacking Crypto Malware Found On Google Play Store

The malware, described as a “Clipper,” masqueraded as a
legitimate cryptocurrency app and worked by replacing
cryptocurrency wallet addresses copied into the Android clipboard
with one belonging to attackers, ESET researcher Lukas Stefanko
explained in a blog
post^[1].

Since cryptocurrency wallet addresses are made up of long
strings of characters for security reasons, users usually prefer
copying and pasting the wallet addresses using the clipboard over
typing them out.

The newly discovered clipper malware, dubbed Android/Clipper.C by
ESET, took advantage of this behavior to steal users
cryptocurrency.

To do this, attackers first tricked users into installing the
malicious app that impersonated a legitimate cryptocurrency service
called MetaMask, claiming to let users run Ethereum
decentralized apps in their web browsers without having to run a
full Ethereum node.

Officially, the legitimate version of MetaMask is only available
as a web browser extension for Chrome, Firefox, Opera, or Brave,
and is not yet launched on any mobile app stores.

However, Stefanko spotted the malicious MetaMask app on Play
Store targeting users who want to use the mobile version of the
service by changing their legitimate cryptocurrency wallet address
to the hacker’s own address via the clipboard.

As a result, users who intended to transfer funds into a
cryptocurrency wallet of their choice would instead make a deposit
into the attacker’s wallet address pasted by the malicious app.

While the bitcoin price has been dropped steadily since hitting
its all-time high in December 2017, there is no reduction (in fact
rise) in the cryptocurrency scandals, thefts, and scams that
continue to plague the industry.

Just last week, The Hacker News reported how customers of the
largest Canadian bitcoin exchange QuadrigaCX lost
$145 million^[3] in cryptocurrency after
the sudden death of its owner who was the only one with access to
the company’s cold (offline) storage wallets. However, some users
and researchers are suggesting the incident could be an exit
scam.