ClipXDaemon Linux Malware Hijacks Cryptocurrency Addresses via X11 Clipboard
Summary
Cyble CRIL describes ClipXDaemon, a C2-less Linux malware that monitors X11 clipboards and swaps cryptocurrency addresses. It uses a three-stage loader, persists via ~/.profile, and exits when it detects Wayland.
Key points
- Cyble’s Research & Intelligence Labs identified ClipXDaemon, which targets Linux systems using X11; it terminates if it detects a Wayland session.
- The three-stage chain uses a bincrypter-generated encrypted loader, an AES-256-CBC memory-resident dropper, and an on-disk ELF daemon.
- The malware persists by writing to ~/.local/bin and adding an execution line to ~/.profile, without requiring root privileges.
- It daemonizes, disguises its process as “kworker/0:2-events,” and polls the X11 clipboard every 200 milliseconds.
- ChaCha20-encrypted patterns and replacement addresses let it detect and replace cryptocurrency wallet addresses; researchers observed replacement addresses for several currencies, but not TON or Ripple.
- Researchers found no DNS queries, HTTP requests, socket connections, or other network activity during analysis.
- The loader resembles samples associated with ShadowHS, but researchers found no evidence that the two threats share operators or authors.
Article Details
- Attack Vectors
- A three-stage chain uses a bincrypter-generated encrypted loader, a memory-resident dropper decrypted with AES-256-CBC, and an on-disk ELF payload.
- The malware monitors X11 clipboard contents and replaces recognized cryptocurrency wallet addresses with attacker-controlled addresses.
- The dropper writes the binary under ~/.local/bin and adds an execution line to ~/.profile for persistence across user logins.
- The malware disguises its process as “kworker/0:2-events” and terminates if it detects a Wayland session.
- Defensive Notes
- The reported clipboard-hijacking behavior requires an X11 session; the malware terminates when it detects Wayland.
- During analysis, the malware performed no DNS queries, HTTP requests, or socket connections, so the article reports no network indicators for this sample.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe loader and wallet-pattern configuration use encrypted data to obscure their contents.T1036.005 · Match Legitimate Resource Name or LocationClipXDaemon renames its process to “kworker/0:2-events” to resemble a kernel worker thread.T1059.004 · Unix ShellThe infection chain uses an encrypted shell-script loader and executes the intermediate dropper as a script.T1115 · Clipboard DataClipXDaemon polls the X11 clipboard every 200 milliseconds and replaces copied cryptocurrency wallet addresses.T1140 · Deobfuscate/Decode Files or InformationThe loader decodes and decrypts its payload, and the malware decrypts wallet patterns and replacement addresses at runtime.T1546.004 · Unix Shell Configuration ModificationThe dropper appends a command to ~/.profile to run the malware during future login sessions.
Malware
ClipXDaemonResearchers identified ClipXDaemon, a Linux clipboard hijacker that targets cryptocurrency users by monitoring X11 clipboards and replacing copied wallet addresses with attacker-controlled ones to redirect funds.ShadowHSThe loader resembles ShadowHS samples due to use of the open-source bincrypter framework, but ClipXDaemon operates C2-less, persists via ~/.profile, and uses process masquerading and Wayland checks to remain stealthy.