GCVE-110-OSM-2026-673

This malware is designed to intercept and manipulate cryptocurrency transactions. It operates by monitoring the system clipboard and silently replacing copied wallet addresses with those controlled by an attacker. When a victim pastes what they believe to be their intended address, the transaction is redirected elsewhere—often permanently. The malware monitors clipboard activity on the victim’s device. Whenever a wallet address (BTC, ETH, etc.) is copied, the malware detects the format. It substitutes the copied address with one belonging to the attacker. The victim unknowingly pastes and confirms the wrong address, sending funds to the attacker. Because most crypto transactions are irreversible, recovery is virtually impossible.