--- title: "From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker" url: https://daily.dev/posts/from-stars-to-upvotes-fake-reputation-fueling-a-crypto-clipboard-hijacker-ciw07pfke source_url: https://research.checkpoint.com/2026/from-stars-to-upvotes-fake-reputation-fueling-a-crypto-clipboard-hijacker type: article source: "Check Point Research" published: 2026-06-17T13:45:37.359Z updated: 2026-06-17T14:08:58.355Z tags: ["security", "rust", "malware"] reading_time: 19 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker **[Check Point Research](https://daily.dev/sources/cpresearch)** · 19 min read · 0 upvotes · 0 comments ## Summary Check Point Research exposes a multi-platform malware campaign distributing Rust-based cryptocurrency clipboard hijackers for Windows and macOS. The threat actor disguises payloads as Solana sniper bots, Aviator Predictors, and crash-game tools, then uses Ghost Networks of fake accounts across GitHub, SourceForge, YouTube, and even VirusTotal to inflate stars, downloads, views, and 'safe' votes. The Windows variant embeds over 15,500 attacker-controlled wallet addresses covering Bitcoin, Ethereum, Monero, and many others; the macOS variant uses a similar design with one wallet per currency. Persistence is achieved via Windows Startup shortcuts and macOS LaunchAgent plists with a self-healing watchdog. Over 5,000 downloads were tracked on GitHub alone, with 44,000+ on SourceForge (many likely artificial). The campaign also abused news outlets and crypto forums for coordinated promotion, demonstrating how fake reputation manipulation across multiple platforms can lower victim suspicion and bypass reputation-based security controls. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Crypto Heist Fueled by Elaborate Fake Reputation Campaign](https://daily.dev/posts/crypto-heist-fueled-by-elaborate-fake-reputation-campaign-jl8cj7yzf) · Dark Reading · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#rust](https://daily.dev/tags/rust), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/from-stars-to-upvotes-fake-reputation-fueling-a-crypto-clipboard-hijacker-ciw07pfke)