Academy
TermAttack

Wallet theft

Infostealers stealing desktop wallet files, browser wallet extensions and recovery phrases, or replacing a copied wallet address.

Flow

  1. 1Finds wallets
  2. 2Copies
  3. 3Watches the clipboard
Related families
CryptBot, Masad Stealer, ClipBanker
MITRE ATT&CK
T1657 · Financial Theft
Sources
5 sources
01

Overview

Assets whose wallet file or recovery phrase is captured can be moved directly without a password or a bank; the transaction cannot be reversed. MITRE ATT&CK

The second method is clipboard hijacking: when the user copies a wallet address, the malware replaces it with the attacker’s address. MITRE ATT&CK

02

How it works

  1. 1

    Finds wallets

    It scans known desktop wallet folders and browser extension storage. MITRE ATT&CK

  2. 2

    Copies

    It adds wallet files and extension data to the log. MITRE ATT&CK

  3. 3

    Watches the clipboard

    In clipboard-hijacking types, the copied address is replaced instantly. MITRE ATT&CK

03

Real-world examples

Masad: clipboard hijacking and Telegram

Masad Stealer profile

Masad Stealer replaced crypto wallet addresses in the clipboard and sent the data it stole via a Telegram bot. Juniper

04

How to detect it

  • A process that is not a wallet application accessing wallet folders. MITRE ATT&CK
  • Background processes that access the clipboard constantly. MITRE ATT&CK
05

What to do

  • Keep large holdings in a hardware wallet; do not store the recovery phrase on the device.
  • Before sending, compare the first and last characters of the pasted address. MITRE ATT&CK
06

MITRE ATT&CK

T1657Financial TheftT1115Clipboard DataT1005Data from Local System
07

Related families and terms

Families

CryptBotActiveMasad StealerInactiveClipBankerDeclining

Report

Infostealer Threat Report — October 2026

Terms

InfostealerStealer logsJoiner
08

Sources

  1. 1Financial Theft (T1657) · MITRE ATT&CK
  2. 2Clipboard Data (T1115) · MITRE ATT&CK
  3. 3Data from Local System (T1005) · MITRE ATT&CK
  4. 4Malicious KMSPico installers steal cryptocurrency wallets · BleepingComputer
  5. 5Masad Stealer: exfiltrating using Telegram · Juniper, 2019
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans