AnimateClipper

AnimateClipper is a cryptocurrency clipper malware family that monitors the Windows clipboard and replaces copied wallet addresses with attacker-controlled alternatives, enabling silent redirection of cryptocurrency transactions. It is associated with large-scale malware distribution campaigns that impersonate legitimate software download sites, including portals for developer, reverse-engineering, and freeware tools, and that use search-engine manipulation and gated traffic distribution infrastructure to selectively deliver payloads.

Observed delivery includes ClickFix-style lures in which victims are presented with a fake verification prompt and tricked into launching a remote script through native Windows utilities. Reported infection chains include script-based staging, PowerShell execution, RC4 decryption, use of a bundled Python environment, and in-memory shellcode execution before the final payload is loaded. The malware has been described as supporting more than 20 blockchain ecosystems.

AnimateClipper’s core function is crypto theft through clipboard substitution rather than credential harvesting. By silently hijacking copied wallet addresses, it can cause victims to send funds to attacker-controlled wallets without obvious signs of compromise. It has been observed alongside other payloads such as RemusStealer and SessionGate in campaigns that rely on fake software sites, SEO poisoning, and traffic filtering to evade researchers and deliver malware selectively. The malware targets Windows systems and is particularly relevant to users downloading software from impersonation sites and to cryptocurrency users whose transactions depend on clipboard-copied wallet addresses.