Malware
ClipXDaemon
- First Reported
- Mar 6, 2026
- Latest Reported
- Mar 13, 2026
Reported Context (3)
- Notable incidents include the Handala wipe of over 200,000 Stryker devices and the ClipXDaemon Linux cryptoâwallet hijacker, alongside India’s Aadhaar bug bounty and Microsoft’s March 2026 patch releases—underscoring Weekly Roundup Covers Handala’s Stryker Claim, ClipXDaemon, Espionage Warnings and March Patches
- Researchers identified ClipXDaemon, a Linux clipboard hijacker that targets cryptocurrency users by monitoring X11 clipboards and replacing copied wallet addresses with attacker-controlled ones to redirect funds. ClipXDaemon Linux Malware Hijacks Cryptocurrency Addresses via X11 Clipboard
- Cyble identified ClipXDaemon, an autonomous Linux clipboard hijacker that targets X11 sessions to intercept and replace copied cryptocurrency wallet addresses with attacker-controlled addresses, operating entirely ClipXDaemon Malware Hijacks Cryptocurrency Clipboard Addresses in Linux X11 Sessions
Malware (1)
Threat Actors (1)
MITRE ATT&CK (10)
Vendors (1)
Products (10)
Tools (1)
Industries (4)
Countries (5)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.