ClipXDaemon Malware: New Crypto Clipboard Hijacker on Linux

Security researchers have identified a new Linux malware , dubbed ClipXDaemon , that targets crypto users . Cyble Research & Intelligence Labs ( CRIL ) discovered that the malware is distributed via a loader structure that has previously been linked to ShadowHS activity.

Despite this structural similarity, researchers say there is no evidence that ClipXDaemon and ShadowHS share the same operators or malware creators. Instead, both threats appear to be based on bincrypter, an open-source shell-script encryption framework hosted on GitHub.

ClipXDaemon: A threat to crypto users on Linux

Unlike traditional Linux malware, which relies on remote infrastructure, ClipXDaemon operates as a fully autonomous cryptocurrency clipboard. It does not contain any command and control (C2) functionality, does not perform beaconing, and does not require instructions from remote servers. Instead, the malware exploits victims directly. Once installed on a Linux system running an X11 graphical environment, ClipXDaemon addresses cryptocurrency wallet with those controlled by the attacker (in real time).

See also: The Evolution of Ransomware in 2026: Techniques and Organizational Protection

If a victim pastes the address into a transaction field, the funds are transferred to the attacker.

Researchers noted that the malware checks the execution environment before execution. If it detects a Wayland, the program terminates immediately.

Links to ShadowHS via common loader

The initial loader used in the campaign resembles one previously observed in samples of the ShadowHS malware . However, the similarity appears to stem from the use of bincrypter.

In January, ShadowHS was documented as a malware family that deployed encrypted shell loaders to execute a weaponized hackshell payload that targeted server environments for post-exploit activities. In contrast, ClipXDaemon delivers an entirely different payload: a Linux-based cryptocurrency clipboard hijacker.

Multi-stage infection chain

The ClipXDaemon campaign uses a three-stage infection process :

1. Encrypted Loader: A bincrypter-generated script and contains an encrypted payload blob.

2. Memory-Resident Dropper: Decrypted in memory using AES-256-CBC and gzip decompression.

3. On-Disk ELF Payload: A clipboard-hijacking daemon that writes to disk.

The loader stores encrypted data inline, decodes it from base64, removes non-printable characters, and derives AES-256-CBC parameters, before executing the decrypted stage directly from memory. Variable naming conventions and use of OpenSSL commands match the standard output of bincrypter.

When the loader decrypts the intermediate dropper, it executes the script via /proc/self/fd, avoiding the creation of visible files and minimizing forensic evidence.

See also: Transparent Tribe: Mass production of malicious applications with AI

Persistence and installation

The decrypted dropper embeds a base64-encoded ELF binary, which writes to the path: ~/.local/bin/ . The filename is randomly generated (eight to nineteen characters with a numeric suffix). After writing the binary, the dropper makes it executable and launches it in the background.

To maintain persistence, ClipXDaemon adds an execution line to the ~/.profile . This ensures that the malware runs during future login sessions, without requiring root privileges, systemd services, or scheduled tasks. The design suggests that attackers are targeting Linux desktop environments rather than servers.

Hiding techniques and process masquerading

Once executed, ClipXDaemon performs a double-fork daemonizationto disconnect from the controlled terminal. It creates a new session, closes the standard file descriptors, and resets the file mode mask.

The malware then calls prctl(PR_SET_NAME, …) to rename the process, disguising itself as a kernel worker thread. Specifically, it mimics the process name “kworker/0:2-events”. This technique is intended to reduce suspicion during casual inspection, using tools such as ps or top (Linux administrators often encounter kernel worker processes and may overlook them).

Clipboard monitoring and cryptocurrency theft

After daemonization, ClipXDaemon connects to the X server using standard X11 APIs. If the connection fails, execution stops. Otherwise, the malware starts monitoring the clipboard contents every 200 milliseconds.

Using the X11 selection protocol, the malware retrieves clipboard data in UTF-8 format via XConvertSelection, XNextEvent, and XGetWindowProperty. The clipboard contents are copied to memory and analyzed for cryptocurrency wallet patterns.

The malware contains encrypted regular expressions for several major forms of cryptocurrencies, including:

• Ethereum: ^0x[0-9a-fA-F]{40}$ 
• Bitcoin: ^(bc1|[13])[a-km-zA-HJ-NP-Z1-9]{$25.34} 
• Monero: ^[4][0-9AB][1-9A-HJ-NP-Za-km-z]{93}$ 
• Dogecoin: ^D{1}[5-9A-HJ-NP-U]{1}[1-9A-HJ-NP-Za-km-z]{32}$ 
• Litecoin 
• Tron 
• Ripple (XRP) 
• TON 

When a match is detected, ClipXDaemon replaces the clipboard contents with a malicious wallet address. The replacement is done quickly enough to occur before a typical paste operation.

See also: Mirax Bot: New Android malware advertised on hacking forum

Observed attacker wallets include:

• Ethereum: 0x502010513bf2d2B908A3C33DE5B65314831646e7 
• Monero: 424bEKfpB6C9LkdfNmg61pMEnAitjde8YWFsCP1JXRYhfu4Tp5EdbUBjCYf9kRBYGzWoZqRYMhWfGAm1N5h6wSPg8bSrbB9 
• Bitcoin: bc1qe8g2rgac5rssdf5jxcyytrs769359ltle3ekle 
• Dogecoin: DTkSZNdtYDGndq1kRv5Z2SuTxJZ2Ddacjk 
• Litecoin: ltc1q7d2d39ur47rz7mca4ajzam2ep74ccdwvqre6ej 
• Tron: TBupDdRjUscZhsDWjSvuwdevnj8eBrE1ht 

While the malware also tracks TON and Ripple wallet formats, researchers did not observe address replacements for these assets.

Configuration Encryption and C2-Less Malware Model 

To hide its configuration, ClipXDaemon encrypts wallet patterns and replacement addresses using the ChaCha20 stream cipher. A 256-bit static key and a counter decrypt these values ​​at runtime before writing the regular expressions into memory.

Although this method prevents simple static analysis, the researchers say it provides only limited protection against dynamic analysis.

One of the most notable features of ClipXDaemon is the absence of any network communication. When analyzed, the binary did not perform DNS queries, HTTP requests, or socket connections , and did not contain embedded domains or IP addresses.

This C2-less architecture changes the traditional malware lifecycle. Without remote infrastructure, attackers don’t need to maintain servers or communicate with infected machines. Instead, exploitation occurs directly when a victim unwittingly sends cryptocurrency to the attacker’s wallet.