Clipboard hijacking
Named by 3 kept items in this workspace.
Search every workspace for Clipboard hijacking. It matches the name as written, so it can find other things that share it.
The items that name it 3
Detects cryptocurrency addresses on the clipboard, exfiltrates them, and replaces them with an attacker-controlled wallet address.
_grab.py polls clipboard ~every 800ms via Win32 API or xclip/xsel, replacing detected crypto addresses with attacker wallets
ZigCryptoStealer polls the clipboard, recognizes cryptocurrency address formats, and substitutes attacker-controlled addresses
All techniques in this workspace.