A malware campaign targeting cryptocurrency users has surfaced with a deceptively simple mechanic: it doesn't crack wallets or steal seed phrases. Instead, it waits for the transaction moment.
McAfee researchers uncovered a malicious browser extension that silently monitors a user's clipboard. When a cryptocurrency wallet address is copied, the malware replaces it with an address owned by the attacker. The victim pastes what they believe is their intended recipient's address into a withdrawal form or payment interface, but the funds route to the attacker instead.
The attack exploits a fundamental trust assumption in cryptocurrency workflows. Users typically copy a destination wallet address, then paste it into a transaction field. This two-step process is treated as verification in many workflows, but the malware intercepts between copy and paste, making detection trivial only if the victim remembers to validate the address before confirming the send.
How the campaign operates
The extension masquerades as a legitimate Google service (researchers identified it using Google branding in its naming and presentation). Once installed, it runs silently in the background without prompts or notifications that would alert a user to its presence. The clipboard replacement occurs without any visible change to the browser or transaction interface.
McAfee's findings underscore a critical vulnerability in user behavior. Most cryptocurrency security guidance emphasizes hardware wallets and seed phrase protection, but addresses the assumption that copied data remains trustworthy. A user who has otherwise secured their private keys can still be compromised by clipboard manipulation if they skip the manual address validation step.
What users should do
The most reliable defense is to independently verify the destination address before confirming any transaction. This means comparing the pasted address against the original source, not relying on the copy-paste cycle as secure. For high-value transfers, typing the address manually or using a hardware wallet's built-in address verification features adds friction that prevents both accidental mistakes and clipboard attacks.
Browser extensions request clipboard access as part of their permissions. Reviewing what an extension can access before installation and removing any extension that requests clipboard permissions without a clear functional need reduces exposure. The malware identified by McAfee mimicked a Google service, which suggests social engineering around trusted brand names remains effective in driving installation.
No indication has emerged yet of how many users have installed the malicious extension or what volume of funds it has stolen. The timeline of its distribution, its prevalence across geographies, and whether other variants of the same attack exist remain unanswered. McAfee's disclosure is the primary confirmed source for this campaign at this time.