Malware
ShadowHS
- First Reported
- Mar 6, 2026
- Latest Reported
- Mar 9, 2026
Reported Context (2)
- The loader resembles ShadowHS samples due to use of the open-source bincrypter framework, but ClipXDaemon operates C2-less, persists via ~/.profile, and uses process masquerading and Wayland checks to remain stealthy. ClipXDaemon Linux Malware Hijacks Cryptocurrency Addresses via X11 Clipboard
- In early February 2026, Cyble Research & Intelligence Labs (CRIL) identified a new Linux malware strain delivered through a loader structure previously associated with ShadowHS activity. ClipXDaemon Malware Hijacks Cryptocurrency Clipboard Addresses in Linux X11 Sessions
Malware (1)
MITRE ATT&CK (8)
Tools (1)
Industries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.