PasteSwitch

PasteSwitch is a cross-platform malvertising and ClickFix malware-delivery operation targeting macOS and Windows users. It abuses trusted advertising distribution channels, including a compromised verified social-media advertising account, to promote counterfeit streaming, AI/developer-tool, disk-utility, and cryptocurrency-wallet software. Victims are directed to fraudulent landing pages and socially engineered to paste attacker-supplied commands into macOS Terminal or Windows execution dialogs, causing attacker-controlled code to run without relying on a software vulnerability.

The operation dynamically selects lures, payloads, and monetization paths based on the victim environment. Its macOS branches have delivered MacSync, Atomic macOS Stealer-related helpers, and fraudulent wallet applications designed to collect browser credentials and data, macOS passwords, messaging-application data, notes, and cryptocurrency recovery phrases. Windows branches have used InstallFix and Amatera Stealer, including obfuscated in-memory execution, scheduled-task creation, and attempts to impair AMSI. PasteSwitch also distributes the AnimateClipper and ZigClipper cryptocurrency clippers, which monitor the clipboard and replace copied cryptocurrency-wallet addresses with attacker-controlled addresses. The clipper components use blockchain smart contracts as mutable command-and-control dead drops. PasteSwitch is tracked as an operation rather than a single malware family; no public attribution to a specific threat actor is established.