Tool
bincrypter
- First Reported
- Mar 6, 2026
- Latest Reported
- Mar 9, 2026
Reported Context (2)
- The loader resembles ShadowHS samples due to use of the open-source bincrypter framework, but ClipXDaemon operates C2-less, persists via ~/.profile, and uses process masquerading and Wayland checks to remain stealthy. ClipXDaemon Linux Malware Hijacks Cryptocurrency Addresses via X11 Clipboard
- The threat is delivered via a bincrypter-based encrypted shell loader, stages an in-memory dropper and a persisted ELF under ~/.local/bin, and uses ChaCha20-encrypted regexes, process masquerading, and Wayland avoidance ClipXDaemon Malware Hijacks Cryptocurrency Clipboard Addresses in Linux X11 Sessions
Malware (2)
MITRE ATT&CK (8)
Industries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.