How to eliminate ClipWallet malware from your Mac
Written by Tomas Meskauskas on (updated)
What kind of malware is ClipWallet?
ClipWallet is a clipper-type malware that targets multiple operating systems, including macOS, Windows, and Linux/Unix. This malicious program is written in the Go programming language.
ClipWallet is designed to reroute outgoing cryptocurrency transactions by replacing digital wallet addresses. This malware has been observed being injected into devices by a fake CloudChat app.
ClipWallet malware overview
One of the known methods used to infiltrate ClipWallet into systems is through a fake CloudChat application. Hence, victims themselves may install this app, which then injects the clipper malware into their devices.
The purpose of ClipWallet is to redirect outgoing cryptocurrency transactions to wallets owned by cyber criminals. The malicious program can detect when a victim copies the address of a cryptowallet into the clipboard (copy-paste buffer). The copied content is then replaced with an address of a criminal-owned wallet.
Hence, when a victim pastes the address and transfers their funds, they are unintentionally sent to the cyber criminals behind the infection.
The scope of the financial loss depends on the value of the stolen digital assets. It must be mentioned that cryptocurrency transactions cannot be reversed due to their nearly untraceable nature. Therefore, victims cannot retrieve their funds.
Keep in mind that malware developers often improve upon their creations and methodologies. Hence, future iterations of ClipWallet could have additional/different capabilities or features (updated information below).
| Name | ClipWallet malware |
| Threat Type | Mac Malware, Mac Virus, Clipper, Clipboard Hijacker. |
| Detection Names (fake CloudChat that injects ClipWallet) | Avast (MacOS:Downloader-CG [Drp]), ESET-NOD32 (OSX/TrojanDownloader.Agent.AJ), Kaspersky (HEUR:Trojan.OSX.Patched.gen), Symantec (OSX.Trojan.Gen), Full List Of Detections (VirusTotal) |
| Detection Names (ClipWallet) | Avast (MacOS:Stealer-AF [Trj]), Combo Cleaner (Trojan.MAC.Generic.118374), ESET-NOD32 (OSX/PSW.Agent.AX), Kaspersky (HEUR:Trojan-PSW.OSX.Agent.gen), Full List Of Detections (VirusTotal) |
| Symptoms | Trojans are designed to stealthily infiltrate the victim's computer and remain silent, and thus no particular symptoms are clearly visible on an infected machine. |
| Distribution Methods | Free software installers (bundling), infected email attachments, malicious online advertisements, social engineering, software 'cracks'. |
| Damage | Stolen cryptocurrency, financial loss. |
| Malware Removal (Mac) | To eliminate possible malware infections, scan your Mac with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. |
Malware in general
We have investigated thousands of malicious programs. Malware can have a wide variety of capabilities, ranging from malignant code injection to replacing clipboard content. In fact, clipper abilities can be just a single feature of versatile malware.
It must be stressed that regardless of how malicious software operates – its presence on a system threatens device integrity and user safety. Hence, all threats must be removed immediately upon detection.
RustDoor, Activator, ObjCShellz, KandyKorn, and MetaStealer are merely a few articles on malware-specific malware that we have published recently.
How did ClipWallet infiltrate my computer?
ClipWallet has been observed being proliferated via a fake CloudChat app (screenshot below). Malicious software is often disguised as or bundled with legitimate/ordinary programs.
Malware-bearing applications may be acquired through a variety of suspicious download sources, e.g., deceptive promotional webpages, freeware and free file-hosting websites, Peer-to-Peer sharing networks, third-party app stores, etc. However, ClipWallet could be spread by using other techniques as well.
Aside from untrustworthy download channels, malware is commonly distributed via drive-by (stealthy/deceptive) downloads, online scams, malicious attachments/links in spam (e.g., emails, SMSes, DMs/PMs, social media/ forum posts, etc.), malvertising, pirated programs/media, illegal software activation ("cracking") tools, and fake updates.
Furthermore, some malicious programs can self-proliferate through local networks and removable storage devices (e.g., external hard drives, USB flash drives, etc.).
How to avoid installation of malware?
We highly recommend researching software and downloading it only from official/verified sources. Additionally, all programs must be activated and updated using functions/tools provided by legitimate developers, as those acquired from third-parties can contain malware.
We advise vigilance while browsing since fake and dangerous online content usually appears genuine and harmless. Another recommendation is to treat incoming emails and other messages with caution. Attachments or links found in suspicious mail must not be opened, as they can be infectious.
We must emphasize the importance of having a reputable anti-virus installed and kept updated. This software must be used to perform regular system scans and to remove detected threats. If your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for macOS to automatically eliminate the infection.
Fake CloudChat app used to infiltrate ClipWallet clipper into systems (image source – Yogesh Londhe):
Update April 23, 2024 – new variant of ClipWallet malware has been discovered. The program can exfiltrate suspected digital wallet private keys via Telegram rather than pasting criminal-owned cryptowallet addresses to reroute outgoing transactions. The program targets Bitcoin, Ethereum, and Tron private keys.
ClipWallet also seeks data associated with popular cryptocurrency-related extensions compatible with the Google Chrome browser. The new variant of ClipWallet also includes the ability to steal files from the desktop and downloads folders. It also collects detailed information regarding files of interest.
Instant automatic Mac malware removal:
Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of Mac malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner for Mac
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.
Quick menu:
Potentially unwanted applications removal:
Remove potentially unwanted applications from your "Applications" folder:
Click the Finder icon. In the Finder window, select "Applications". In the applications folder, look for "MPlayerX","NicePlayer", or other suspicious applications and drag them to the Trash. After removing the potentially unwanted application(s) that cause online ads, scan your Mac for any remaining unwanted components.
Frequently Asked Questions (FAQ)
My computer is infected with ClipWallet malware, should I format my storage device to get rid of it?
Malware removal rarely requires formatting.
What are the biggest issues that ClipWallet malware can cause?
The threats associated with an infection depend on the malware's functionalities and the cyber criminals' modus operandi. ClipWallet is a clipper – it replaces copied cryptowallet addresses with ones of attacker-owned wallets. The goal is to reroute outgoing cryptocurrency transactions, thus stealing the digital assets.
What is the purpose of ClipWallet malware?
Malware is primarily used to generate revenue, and based on ClipWallet's capabilities – it is no exception. However, malicious programs can be used for other purposes as well. Cyber criminals can utilize malware to amuse themselves, carry out personal vendettas, disrupt processes (e.g., sites, services, companies, etc.), engage in hacktivism, and launch politically/geopolitically motivated attacks.
How did ClipWallet malware infiltrate my computer?
ClipWallet has been noted being injected into systems by a fake CloudChat application. However, other infiltration/proliferation methods are possible.
Generally, malware is spread via drive-by downloads, spam mail, online scams, malvertising, dubious download sources (e.g., freeware and free file-hosting sites, P2P sharing networks, third-party app stores, etc.), illegal software activation tools ("cracks"), and fake updates. Some malicious programs can even self-proliferate through local networks and removable storage devices.
Will Combo Cleaner protect me from malware?
Yes, Combo Cleaner is designed to scan devices and remove all kinds of threats. It is capable of detecting and eliminating most of the known malware infections. Keep in mind that since high-end malicious programs usually hide deep within systems – running a complete system scan is crucial.
Outstanding!
▼ Show Discussion