ClipXDaemon Malware Hijacks Cryptocurrency Clipboard Addresses in Linux X11 Sessions
Summary
Cyble analyzed ClipXDaemon, Linux malware that replaces copied cryptocurrency addresses in X11 sessions. It uses a bincrypter-based loader, user-level persistence and process masquerading, and operates without C2; no link to ShadowHS authorship was established.
Key points
- Cyble reports identifying ClipXDaemon in early February 2026 and says there is no evidence it shares an author or campaign with ShadowHS; both used the public bincrypter tool.
- The delivery chain uses an AES-256-CBC and gzip loader, an in-memory dropper, and an ELF payload saved under ~/.local/bin; the dropper adds a launch command to ~/.profile for user-level persistence.
- The payload exits in Wayland sessions and targets X11, polling the clipboard every 200 milliseconds and replacing matching cryptocurrency addresses with embedded attacker-controlled addresses.
- The malware daemonizes and masquerades as a kernel worker process; wallet patterns and replacement addresses are encrypted with ChaCha20 and decrypted in memory.
- Cyble observed no DNS, HTTP, or socket activity and reports no C2 channel; monetization depends on victims pasting a substituted address and completing a transaction.
- The article recommends endpoint behavioral monitoring, auditing user-level startup files and new executables in ~/.local/bin, detecting suspicious X11 clipboard API use, and verifying wallet addresses before transactions.
Article Details
- Attack Vectors
- A bincrypter-obfuscated shell loader decrypts and decompresses an embedded payload, then executes the intermediate dropper from memory through /proc/self/fd.
- The dropper writes a randomized ELF payload to ~/.local/bin/, launches it, and appends an execution line to ~/.profile for user-level persistence.
- ClipXDaemon operates in X11 sessions, polling the clipboard every 200 milliseconds and replacing matched cryptocurrency wallet addresses with embedded attacker-controlled addresses.
- The payload exits in Wayland sessions and disguises its process as kworker/0:2-events using process-name and argv[0] modification.
- Wallet-matching regexes and replacement addresses are stored in the binary encrypted with ChaCha20 and decrypted in memory.
- Defensive Notes
- Where feasible, use Wayland sessions to reduce exposure to global clipboard scraping.
- Restrict execution from user-writable directories such as ~/.local/bin/ and alert on newly created executables there.
- Audit modifications to ~/.profile, ~/.bashrc, and other user-level autostart files.
- Investigate kernel-thread-like process names, such as kworker/*, when used by processes running under non-root user contexts.
- Monitor for repetitive X11 clipboard API activity, including XConvertSelection, XSetSelectionOwner, and XGetWindowProperty.
- Use endpoint behavioral monitoring to detect shell-launched ELF files written from base64 data, execution through /proc/self/fd, and double-fork daemonization.
- Encourage manual verification of cryptocurrency addresses before transactions are confirmed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 23099eea9c4f85ff62a4f43634d431bbed0bf6b039a3f228b1c047f1c2f0cd11 | SHA-256 hash identified for the in-memory dropper script used in the ClipXDaemon delivery chain. |
| SHA256 | 87ab42a2a58479cf17e5ce1b2a2e8f915d539899993848e5db679c218f0e7287 | SHA-256 hash identified for the bincrypter loader script used to deliver ClipXDaemon. |
| SHA256 | b6bb28160532400eafad532842e4ba9add6d6bbba4f7e7c85e3dbb650369eb00 | SHA-256 hash identified for the ClipXDaemon ELF binary. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe loader uses AES-256-CBC and gzip staging, while the payload stores wallet regexes and replacement addresses encrypted with ChaCha20.T1036.005 · Match Legitimate Resource Name or LocationThe payload changes its process name and argv[0] to mimic the kernel worker name kworker/0:2-events.T1056.004 · Credential API HookingClipXDaemon polls the X11 clipboard and reads copied cryptocurrency wallet addresses before replacing matched values.T1059.004 · Unix ShellA shell-script loader base64-decodes an embedded payload and executes the decrypted stage from memory through /proc/self/fd.T1547.001 · Registry Run Keys / Startup FolderThe dropper appends an execution line to ~/.profile to run the payload during future interactive login sessions.
Malware
ClipXDaemonCyble identified ClipXDaemon, an autonomous Linux clipboard hijacker that targets X11 sessions to intercept and replace copied cryptocurrency wallet addresses with attacker-controlled addresses, operating entirelyShadowHSIn early February 2026, Cyble Research & Intelligence Labs (CRIL) identified a new Linux malware strain delivered through a loader structure previously associated with ShadowHS activity.