Laplas Clipper

Laplas Clipper is a clipboard hijacker malware that specifically targets cryptocurrency users. It monitors the victim's clipboard for cryptocurrency wallet addresses and replaces them with an attacker-controlled address. This results in fraudulent transactions, redirecting funds to the malicious wallet without the user's knowledge.

Key Insights

Laplas Clipper continuously scans the clipboard for cryptocurrency wallet addresses. Once detected, it replaces the original address with a lookalike controlled by the attacker. This manipulation is often unnoticed by the victim, leading to significant financial losses when they proceed with the transaction.

Distribution Methods

The malware is typically spread through phishing campaigns, where users are tricked into downloading malicious files. After installation, Laplas Clipper operates silently in the background, making it difficult to detect without specialized security tools.

Impact on Cryptocurrency Transactions

Laplas Clipper's primary threat lies in its ability to alter wallet addresses during cryptocurrency transactions. Given the irreversible nature of such transactions, the attacker can effectively redirect the funds to their own wallet, leaving the victim with no recourse to recover the stolen funds.

Known Variants

Laplas Clipper has been observed in multiple forms, including C++-based versions, with both EXE and DLL file types. Future updates are expected to add functionality that checks the victim's cryptocurrency wallet balance, increasing its capabilities.

Mitigation Strategies

Always double-check cryptocurrency wallet addresses before confirming transactions.
Download software and plugins only from trusted, official sources.
Use reliable security software to detect and block malware.
Stay informed about emerging cybersecurity threats and best practices.

Targeted Industries or Sectors

The malware primarily targets individual cryptocurrency users. It is not tied to any particular industry but poses a significant risk to anyone involved in cryptocurrency transactions.

Associated Threat Actors

Specific details regarding the threat actors behind Laplas Clipper remain unclear. However, it is sold as Malware-as-a-Service (MaaS) on platforms like Telegram channels and Darknet forums, suggesting its distribution among multiple threat actors.