OAK — OnChain Attack Knowledge

Worked example · 2026-06

Rust crypto-clipper — fake-reputation "Ghost Network" distribution of trojanised trading tools — Windows + macOS / cross-chain — disclosed 2026-06-17

Loss
undisclosed (notable illicit gains). Check Point Research did not publish an aggregate theft figure; it reported that attacker-controlled wallets "appear to have received multiple transactions," giving the operator "notable illicit gains." The campaign's reach is measurable through its distribution counters: 44,485 downloads on SourceForge (of which ~37,460 originated from Android despite the malware being Windows/macOS-only — an "Android farm" inflation signal), just over 5,000 downloads across six malicious GitHub accounts, and over 1,250 downloads of the macOS "Aviator Predictor" build; Check Point assessed real reach "significantly exceeds" the disclosed numbers.
OAK Techniques observed
OAK-T4.012 (Clipboard-Hijacker / Clipper Address Substitution — primary; a Rust clipboard hijacker monitors the clipboard via OS APIs, detects cryptocurrency addresses by regex, and replaces them with attacker wallets drawn from embedded address lists. The Windows variant carries over 15,500 attacker addresses — roughly 15,000 Bitcoin-format, ~500 Ethereum, plus others — across 14+ coins (Bitcoin bech32/legacy/P2SH, Ethereum, Litecoin, Monero, Dogecoin, Cardano, Tron, XRP, Zcash, Bitcoin Cash, Bitcoin Gold, Stellar, Solana); the macOS variant uses a single wallet per currency. See techniques/T4.012-clipboard-hijacker-clipper-address-substitution.md). OAK-T4.012.002 (reputation-laundered fake-software clipper distribution sub-shape — the load-bearing delivery shape: the operator manufactured fake trust across many platforms to push trojanised "trading tools"; forward candidate tracked in TAXONOMY-GAPS).
Attribution
pseudonymous. Check Point tied the campaign to a single actor using the Telegram handle @JoseCmanXD, who is also the WordPress author, the YouTube channel owner, and a forum user active since 2019; no real-world identity was published. Early lineage traces to a 2022 BitcoinTalk post titled "BLACKHAT | Bitcoin Stealer | Advanced Builder."
Key teaching point
The clipper payload is commodity; the innovation is the manufactured reputation that carries it past user and platform trust signals. This campaign is the canonical 2026 anchor for the distribution sub-shape of OAK-T4.012: the same clipboard-substitution primitive as any clipper, but delivered through a coordinated "Ghost Network" that fabricates legitimacy — paid/promoted posts on real news sites, AI-generated narrator tutorial videos on YouTube, manipulated VirusTotal votes and "safe" comments, decoy GitHub repos with fake stars/forks, SourceForge counters inflated by Android download farms, a WordPress phishing hub, and EIN Presswire press releases syndicated through mainstream partner networks. The lures target people predisposed to run unvetted binaries — seekers of Solana/Pump.fun sniper bots, Aviator Predictor and crash-game "predictor" tools — so the social-engineering substrate is greed plus a veneer of crowd validation. The defender takeaways span two layers: at the distribution layer, treat coordinated reviews, AI-narrated install guides, inflated download counters, and benign VirusTotal votes on freshly-published "profit" tools as adversarial signals, and install tooling only from verified first-party sources; at the wallet layer, the same control that defeats every clipper applies — verify the full destination address with checksum at sign time, because a same-format substitute from a 15,500-entry table will otherwise pass.

Summary

On 2026-06-17, Check Point Research published "From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker," documenting a Rust-based clipper distributed through manufactured reputation rather than a traditional exploit chain. On Windows, a .NET loader executes the Rust clipper binary and persists by copying to %APPDATA%\silke\silke.exe with a Startup-folder shortcut; on macOS, the malware ships as a bundle with an unlocker.command helper that bypasses Gatekeeper and persists via a LaunchAgent plist. The clipper monitors the clipboard, matches cryptocurrency addresses by regex, and swaps in attacker addresses from embedded lists — the Windows build carrying over 15,500 addresses across 14+ coins, the macOS build a single wallet per currency.

The distinguishing feature is the distribution apparatus. The operator (@JoseCmanXD) ran a WordPress landing hub and pushed fake "solutions" — Solana and Pump.fun sniper bots, Aviator Predictor, and crash-game prediction tools — through: six GitHub accounts (Decryptor-j, crash-predictor1, roblox-script1, hack-scripts, stake-mines) with fabricated stars/forks and just over 5,000 downloads; SourceForge with 44,485 downloads, ~37,460 suspiciously from Android (an inflation farm, since the tools are Windows/macOS-only); YouTube AI-narrator videos with coordinated positive comments; VirusTotal "Ghost Network" benign votes and "safe" comments on malicious samples; paid/promoted posts on legitimate news websites (dated 2026-04-27) and EIN Presswire releases syndicated through USA TODAY Network partners. No traditional C2 was identified — the operation is conducted through the distributed platform footprint itself. Check Point published Windows and macOS sample hashes (e.g. Windows 5518942d…, macOS clipper b71efdeb…, macOS loader 6f12c066…) as indicators.

Timeline (UTC)

When Event OAK ref
2019–2022 Operator @JoseCmanXD active on forums; 2022 BitcoinTalk post "BLACKHAT Bitcoin Stealer
2026-04-27 Paid/promoted posts promoting the fake "trading tools" published across legitimate news websites T4.012.002 (reputation laundering)
Through 2026-06 Rust clipper distributed via WordPress hub, GitHub (×6, >5,000 dl), SourceForge (44,485 dl, ~37,460 Android-farm), YouTube AI-narrator videos, VirusTotal Ghost-Network votes; Windows silke.exe / macOS LaunchAgent persistence; clipboard address substitution from 15,500-entry list T4.012 + T4.012.002
2026-06-17 Check Point Research discloses the campaign ("From Stars to Upvotes"); publishes Windows + macOS IOCs and ties the operation to @JoseCmanXD (defender-side disclosure)

Public references

  • [checkpointclipper2026] — Check Point Research, "From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker" (2026-06-17; Rust clipper, Windows .NET loader → silke.exe, macOS unlocker.command Gatekeeper bypass + LaunchAgent; >15,500 embedded addresses across 14+ coins; distribution via fake reviews, AI-narrated YouTube, VirusTotal Ghost Network, GitHub ×6, SourceForge 44,485 dl, EIN Presswire; operator @JoseCmanXD; IOC hashes): https://research.checkpoint.com/2026/from-stars-to-upvotes-fake-reputation-fueling-a-crypto-clipboard-hijacker/
  • [thehackernewsclipper2026] — The Hacker News, "Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments" (2026-06; secondary coverage of the Check Point campaign; confirms Rust clipper, Windows + macOS targeting, Solana/Pump.fun sniper-bot and crash-game-predictor lures, and the reputation-manipulation distribution model): https://thehackernews.com/2026/06/crypto-clipper-campaign-abuses-fake.html

Discussion

This campaign is the reputation-laundered distribution anchor (T4.012.002) for OAK-T4.012, and the natural companion to the same week's Microsoft CryptoBandits USB-worm clipper (T4.012.001, see examples/2026-06-cryptobandits-usb-worm-tor-clipper.md). The two are mechanistically the same at the payload layer — a host-resident clipboard monitor that swaps a copied crypto address for an attacker's — but differ entirely in how they reach victims: CryptoBandits propagates technically (a .lnk USB worm), while this campaign propagates socially, by manufacturing crowd-validation signals. Together they are the two independent 2026 anchors that move the clipper class out of OAK's taxonomy gap list and into a first-class technique.

The distribution mechanism is structurally adjacent to OAK-T4.010 (Fake Security-Tool / Browser-Extension Phishing) — both deliver a malicious tool by impersonating legitimate software a crypto user would seek out — but the substrate differs: T4.010's surface is the browser-extension store as a trust channel, whereas here the trust channel is a synthetic cross-platform reputation network (reviews, AI videos, scanner votes, repo stars, download counters) wrapped around standalone desktop binaries. See techniques/T4.010-fake-security-tool-browser-extension-phishing.md for the browser-extension sibling. The "Ghost Network" pattern — AI-narrated tutorials, manipulated antivirus-aggregator sentiment, and farmed download counts — is itself a generalisable defence-evasion development worth watching: it targets the heuristics (reviews, reputation, "is this flagged on VirusTotal?") that ordinary users and even some automated pipelines rely on to decide whether software is safe, and it does so at a scale and polish that AI-assisted content production makes increasingly cheap.

Techniques demonstrated (2)