ESET researchers have discovered the first Android malware that can replace the contents of a device’s clipboard on Google Play . The so-called “ clipper ” targets Bitcoin and Ethereum cryptocurrency transactions , aiming to redirect the transfer of funds to the attacker’s wallet instead of the victim’s.
"This discovery shows that clippers , which can redirect cryptocurrency funds, are no longer found only on Windows or in 'suspicious' Android forums . Now, all Android users need to be careful," comments Lukáš Štefanko , Malware Researcher at ESET .
The newly discovered clipper is detected by ESET security solutions as Android/Clipper.C . This malware exploits the fact that those who use cryptocurrency trading features usually do not manually enter their wallet addresses. Instead of typing them, users tend to copy and paste the addresses using the clipboard. The malware can replace the user’s address with one belonging to the attacker.
Clippers first appeared on Windows in 2017. In 2018 , ESET researchers discovered three such malicious applications on download.cnet.com , one of the world’s most popular software hosting sites. In August 2018, the first Android clipper was discovered being sold on hacking forums, and since then, this malware has been detected on many illegal app stores.
Until 2019, Android users who used only the official Google Play app store were completely safe fromclippers .That changed in February 2019 when ESET researchers discovered the first clipper on Google Play. “Fortunately, we detected this clipper as soon as it appeared on Google Play. We reported it to the Google Play security team, who proceeded to remove the appfrom the store”says Lukáš Štefanko.
The clipper discovered by ESET researchers in the Google Play store mimics a legitimate service called MetaMask. MetaMask allows decentralized Ethereum applications to be run in a browser without having to run a full Ethereum node . It is available as extensions only for desktop browsers , such as Chrome and Firefox , and there is no mobile version . 
"It seems that there is a demand for a mobile version of MetaMask. Cybercriminals are aware of this demand and are sneakily introducing malware that mimics this service into Google Play," warns Lukáš Štefanko.
Also, this older malware that mimics MetaMask targets the user's Bitcoin or Ethereum deposits , however, only trying to trick the user into entering the wallet address in a fake form and thus revealing this sensitive information to the attacker.
“Having installed a clipper on the victim’s device, extortion of funds is made very easy. Thevictims themselves unwittingly moneydirectly to the cybercriminal,” explains Lukáš Štefanko.
With the appearance of malware clipper for the first time on Google Play , Android users should be even more careful and follow best practices for their mobile phone security .
To stay safe from clippers and other malware targeting Android , ESET advises users to :
Keep their Android device up to date and use a reliable mobile security solution .
Only use the official Google Play store to download apps...
…However, always check the official website of the app developer or service provider for the link to the official app . If there is nothing related , users should consider it suspicious and be extra cautious with any search results on Google Play .
Thoroughly check every step in all transactions involving anything of value, from sensitive information to money. When using the clipboard,always check that what they pasted is what they intended to insert.
The IOC (Indicators of Compromise) and more technical details can be found in the article.
The discovery coincides with the Mobile World Congress in Barcelona, where ESET is participating. Researcher Lukáš Štefanko will be at the ESET booth and will be available for interviews. ESET will explore Machine Learning/Artificial Intelligence topics, present new research and key findings on mobile security, and showcase its security solutions from its booth (Hall 7, stand 7H41) during the global expo, which will take place February 25-28, 2019 in Barcelona.
