- ReversingLabs analysed two malware families, AnimateClipper and Efimer, that replace copied crypto wallet addresses with addresses the attacker controls.
- The attack works because people trust copy and paste, cannot easily read long addresses, and crypto payments cannot be reversed.
- Teams should treat fake software installs and ClickFix prompts as the entry point, and add a verification step before any large crypto transfer.
The weak point is a glance
Most security thinking protects the machine. This attack goes after a quick look. Someone copies a payment address and pastes it. They assume the pasted text matches what they copied. Clipbanker malware exploits that assumption.
ReversingLabs is a software supply chain security firm. It has published an analysis of two such families, AnimateClipper and Efimer. Its researchers use the term "Clipbanker" for malware with one main goal: swap a copied crypto wallet address for one the attacker controls. The lesson here is that copy and paste has become a trust boundary. In our view, few teams treat it as something to defend.
Why it works on careful people
ReversingLabs names three factors. The first is trust in the clipboard. Copy and paste is automatic, and people assume the right text arrives.
The second is how a wallet address looks. It is a long run of random-looking characters. A wrong street name on a postal address stands out. A wrong character in a wallet address does not.
The third is that crypto transactions cannot be reversed. ReversingLabs says there is no central authority to complain to. A victim has little recourse. A mistyped bank transfer might still be recalled by the bank. That comparison is ours, not the report's.
How the two families operate
AnimateClipper is the newer family. ReversingLabs says it was first picked up in January 2026. It is also called ZigClipper, because its payloads or droppers use the Zig compiler.
It watches the clipboard for text shaped like a wallet address. It works out which cryptocurrency is in use. Then it swaps in an attacker address from the same network.
Efimer is older and more careful. Its replacement address is built to share the first or last few characters with the original. It matches one to three digits from the start or the end, depending on the address type. A person who checks only one end of the address may see nothing wrong.
For Ethereum, the report says Efimer spots an address by its leading "0x" and a length between 40 and 44. It uses similar rules for Bitcoin and Monero. It also sends clipboard contents and screenshots to the attacker.
Efimer is also built to resist analysis. ReversingLabs says it shuts down when it detects analysis tools. It protects its code with Pyarmor and encrypts its payload with XOR. It contacts its control server over TOR, and only at set intervals.
New builds appear every hour, which means 24 fresh samples a day. ReversingLabs says this produces hundreds of samples. That would make exact-hash matching of known files less useful, though this is our inference, not the report's.
The report also describes CryptoBandit, a related family that emerged in 2026. Its digit-matching code overlaps with Efimer's. ReversingLabs says it is likely an evolution of Efimer. The two share wallet and address patterns, control infrastructure, file structure and anti-analysis features.
The entry point is ordinary social engineering
The report says AnimateClipper spread through fake software installs and ClickFix. ClickFix is a trick. A fake error or verification page asks users to paste a command into their own system. AnimateClipper sometimes arrived alongside infostealers. These are programs that harvest saved credentials and data.
Efimer reached victims by several routes. ReversingLabs lists phishing emails, fake torrent sites and fake software. It also lists fake error pages that use ClickFix. The firm adds that sites asking users to verify identity through PowerShell are not legitimate.
One caveat matters. ReversingLabs says both families went quiet soon after its research ended. Its chart of first-seen counts runs from July 14 to October 12, 2026. It shows most activity in July. The report gives no victim numbers or losses. It treats these families as examples of a method, not a current outbreak.
What leaders and teams should do
First, ask where your organisation holds crypto at all. Treasury, vendor payments and staff who handle company wallets are the exposure. If the answer is no one, the direct exposure is small. Staff using personal wallets on work machines would still be worth a question.
Second, if the answer is yes, add a check that does not rely on a glance. ReversingLabs advises verifying the address carefully before sending. One practical version is a second person confirming the full address through a separate channel. A small test transfer before large ones adds more safety. That step is our suggestion, not the report's.
Third, treat a wrong pasted address as a security event. The report asks users whether a mismatch is a typo or "something in your environment that shouldn't be there." Staff should know to report it, not just retype it.
Fourth, close the delivery routes. Train people on fake software downloads and ClickFix prompts. ReversingLabs also recommends scanning files before running them.
The families in this report have gone quiet. The habit they exploit has not changed. A control that checks the payment itself is stronger than one that relies on a person's eyes.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: ReversingLabs.
