Discord Social Engineering Spreads Clipboard Hijacker Targeting Crypto Transactions
Summary
CloudSEK reports that the RedLineCyber actor used Discord relationships to distribute a Python-based Windows clipper that replaces copied wallet addresses for six cryptocurrencies. It persists through a Registry Run key and operates without network communication.
Key points
- The actor posed as a RedLine Solutions affiliate and cultivated contacts in gaming, streaming, gambling, and cryptocurrency Discord communities before sharing the malware as a utility.
- The executable, named Pro.exe or peeek.exe, is a PyInstaller-packaged Python trojan that monitors the Windows clipboard for Bitcoin, Ethereum, Solana, Dogecoin, Litecoin, and Tron addresses.
- When it detects a wallet address, the malware replaces it with an attacker-controlled address and logs the substitution in the user's AppData directory.
- It establishes persistence through the HKCU Windows Registry Run key and polls the clipboard every 300 milliseconds.
- CloudSEK says blockchain analysis found successful theft from multiple victims; the article lists attacker wallet addresses for all six cryptocurrencies.
- The analyzed variant has no observed C2 or other network communication, reducing network-based detection opportunities.
- Suggested hunting indicators include unexpected Registry Run entries, repeated clipboard API calls, and creation of the CryptoClipboardGuard directory or activity log.
Article Details
- Attack Vectors
- The actor built trust with cryptocurrency streamers and other community members on Discord, then distributed Pro.exe or peeek.exe as a purported security or streaming utility.
- The malware was shared directly through Telegram and distributed through targeted Discord communities focused on gaming, gambling, and cryptocurrency streaming.
- Victims were induced to execute the malicious Windows executable manually.
- Defensive Notes
- Monitor Windows Registry Run key additions, especially entries pointing to executables under %APPDATA%.
- Monitor processes for repeated win32clipboard OpenClipboard, GetClipboardData, and SetClipboardText calls; the article identifies continuous polling every 300 milliseconds as a detection opportunity.
- Investigate processes that continuously monitor the clipboard without a legitimate user interface, create logging directories under %APPDATA%, or compile patterns matching cryptocurrency addresses.
- The article recommends blocking the listed attacker-controlled wallet addresses at the organizational level where possible.
- The analyzed malware variant has no network communication or C2 infrastructure; network indicators were not observed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | discord[.]gg | Discord invitation domain used for distribution through targeted communities. |
| SHA256 | 0d6e83e240e41013a5ab6dfd847c689447755e8b162215866d7390c793694dc6 | SHA-256 of the primary malicious sample, Pro.exe/peeek.exe. |
| SHA256 | d011068781cfba0955258505dbe7e5c7d3d0b955e7f7640d2f1019d425278087 | SHA-256 of a related ClipBanker variant reported as observed in the wild. |
MITRE ATT&CK
T1115 · Clipboard DataThe malware polls the Windows clipboard every 300 milliseconds and reads clipboard contents to detect cryptocurrency addresses.T1204.002 · Malicious FileVictims are induced to manually execute the EXE while believing it provides cryptocurrency protection or streaming functionality.T1547.001 · Registry Run Keys / Startup FolderThe malware adds CryptoClipboardGuard under HKCU\Software\Microsoft\Windows\CurrentVersion\Run to run at startup.T1565.001 · Stored Data ManipulationThe malware replaces copied cryptocurrency addresses in clipboard contents with corresponding attacker-controlled wallet addresses.T1566.001 · Spearphishing AttachmentThe article maps Discord-based social engineering and distribution of the executable as a streaming tool to spearphishing attachment.
Threat Actors
Malware
peeek.exeThe operation centers around a malicious executable named "Pro.exe" (also distributed as "peeek.exe"), identified as a Python-based clipboard hijacking trojan designed specifically for silent cryptocurrency theft.Pro.exeThe operation centers around a malicious executable named "Pro.exe" (also distributed as "peeek.exe"), identified as a Python-based clipboard hijacking trojan designed specifically for silent cryptocurrency theft.RedLine StealerThe actor's choice to impersonate "RedLine Solutions" mimicking the notorious RedLine Stealer malware family, serves multiple strategic purposes:
Vendors
Alibaba GroupAlibaba: Trojan.PSW.Win32.Coins.75e4c0cfAviraAvira: TR/AVA.Agent.vfejaBitdefenderBitDefender: Trojan.ClipBankerCloudSEKThrough extensive Human Intelligence (HUMINT) operations conducted in December 2025, CloudSEK's STRIKE team uncovered a sophisticated cryptocurrency theft operation orchestrated by the threat actor operating under theCrowdStrikeCrowdStrike: win/malicious_confidence_100%KasperskyKaspersky: Trojan-Banker.Win32.ClipBanker
Products
DiscordAttack Vector: The threat actor exploits trust relationships within Discord communities focused on gaming, gambling, and cryptocurrency streaming. Distribution occurs through direct social engineering, where the actorMicrosoft Windowscollect broad system data, this malware employs a highly targeted approach: it continuously monitors the Windows clipboard for cryptocurrency wallet addresses and performs real-time substitution withPyInstallerits effective design, the malware demonstrates moderate technical complexity. It is packaged as a PyInstaller executable containing obfuscated Python bytecode, uses base64-encoded regular expressions for walletTelegramThe actor shared the malicious executable "Pro.exe" directly through Telegram and asked to frame it as if it were a clipboard protection tool designed to prevent accidental cryptocurrency address errors during live
Tools
pychaos.ioThe extracted clipboard_guard_obfuscated.pyc file underwent decompilation using the pychaos.io deobfuscation service. This process converted the obfuscated Python bytecode back into readable source code, revealing thepyinstxtractor.pyUsing the pyinstxtractor.py tool, the research team extracted the embedded PyInstaller archive, yielding approximately 100 individual components:VirusTotalDetection Rate: 34/69 antivirus vendors (VirusTotal)
Countries
Australiaover 4,200 LinkedIn login credentials harvested from users in the United States, United Kingdom, Australia, and New Zealand. This parallel activity suggests a diversified criminal operation combining real-timeNew ZealandLinkedIn login credentials harvested from users in the United States, United Kingdom, Australia, and New Zealand. This parallel activity suggests a diversified criminal operation combining real-time cryptocurrencyUnited Kingdom2025, offering over 4,200 LinkedIn login credentials harvested from users in the United States, United Kingdom, Australia, and New Zealand. This parallel activity suggests a diversified criminal operationUnited Statesin October 2025, offering over 4,200 LinkedIn login credentials harvested from users in the United States, United Kingdom, Australia, and New Zealand. This parallel activity suggests a diversified criminal
Industries
Cryptocurrency(HUMINT) operations conducted in December 2025, CloudSEK's STRIKE team uncovered a sophisticated cryptocurrency theft operation orchestrated by the threat actor operating under the alias "RedLineCyber". The actorGamblingVector: The threat actor exploits trust relationships within Discord communities focused on gaming, gambling, and cryptocurrency streaming. Distribution occurs through direct social engineering, where the actorGamingAttack Vector: The threat actor exploits trust relationships within Discord communities focused on gaming, gambling, and cryptocurrency streaming. Distribution occurs through direct social engineering, where the actorStreamingexploits trust relationships within Discord communities focused on gaming, gambling, and cryptocurrency streaming. Distribution occurs through direct social engineering, where the actor cultivates relationships with