‼️ IF YOU USE WINDOWS FOR CRYPTO WALLETS, BE CAREFULL!

‼️ WINDOWS CRYPTO USERS, BEWARE! (MsftSecIntel)

There is a malware built to steal your crypto from the clipboard ( CTRL + C or copy functions) in two ways:

1. replacing the copied address to an address controlled by the threat actor.

2. sending copied seed phrases and private keys to the threat actor’s server.

—

## EXPLANATION

On (1), you can still avoid losing money even if infected by this malware -- just double-check the address you are sending to.

So, when you try to send transactions to alice by copying her 0x123alice...789 address, the script will change the data inside the windows clipboard to 0x123mallory...789 (mallory is the threat actor).

Double-checking protects you (and you should immediately disconnect from the internet and start scanning your device for the malware, or take it to someone who can help you getting rid of the threat).

(2) is self-explanatory: you copy your seed or private key and the attacker receives it in their machine, so they can later import into a wallet and drain your funds freely.

Once you copied it, it’s done. Not much you can do here.

## HOW TO FIND THE MALWARE AND PROTECT YOURSELF

Microsoft says one way to spot the malware is finding 4-6 random character folders in /Documents/ with .js and other unknown files and extensions

Be careful out there!

(and never, NEVER, insert unknown USB drivers and autorun USB files, as this is how you can get infected by this malware in particular).