Clipper Crew Buys Sponsored Posts on News Sites to Push Trojanized Crypto Tools

A still-unattributed crew is running a curiously patient distribution operation: paying for sponsored articles on legitimate news outlets to push downloads of trojanized crypto and trading utilities, per a writeup from Check Point Research.

The lure is mundane. The plumbing is not.

Each paid post links back to a WordPress site that functions as the campaign's hub — slick enough to pass a glance, complete with product pages, screenshots, and "reviews" that read like they were ghostwritten by the same hand. From there, victims are funneled to payloads hosted on GitHub and SourceForge projects, both of which are amplified by what appear to be sockpuppet maintainer accounts to game search ranking and lend the repos a thin patina of legitimacy.

A supporting YouTube channel rounds out the social-proof layer with AI-narrated walkthroughs. The narrator voice is synthetic, the b-roll is generic, and the comments — predictably — are friendly.

The ultimate payload behavior aligns with a clipper: malware that silently watches the clipboard for wallet addresses and swaps them for attacker-controlled ones at paste time. Clippers are unglamorous and devastatingly effective against users moving funds between exchanges and self-custody wallets, because the victim sees a "valid" address right up until the transaction confirms to someone else's chain.

A few operational notes worth flagging for defenders:

• The abuse of paid placement on real news domains means URL reputation and category-based web filtering will not save you. The referring domain is clean. The destination WordPress page is the problem.
• GitHub and SourceForge hosting puts the binaries inside developer-trust allowlists at many shops. EDR telemetry on clipboard-API calls (notably OpenClipboard, GetClipboardData, SetClipboardData) from non-browser, non-office processes is a more reliable signal than blocking the source domain.
• Treat sockpuppet review activity as an IOC class of its own. Repos with thin commit history but suspiciously coordinated stars and issue activity should be reviewed before any installer pulled from them is whitelisted.

Check Point did not name a specific threat group, and the campaign does not currently map cleanly to a known clipper family by infrastructure overlap. The researchers' analysis is the primary source here; expect indicators (hashes, repo names, the WordPress domain) to surface in follow-on posts to their public research blog.

The takeaway is less about a novel exploit and more about the shape of the funnel. Paid editorial, AI-generated video, and seeded developer platforms are now a routine combination for staging commodity malware against retail crypto users. Detection has to move down the stack — to process behavior and clipboard access — because the top of the funnel looks like ordinary marketing.

And that, increasingly, is the point.