A cryptocurrency-stealing malware campaign has been spreading by faking its own popularity, dressing up booby-trapped “tools” with bogus GitHub stars, inflated download counts and AI-narrated YouTube tutorials.

New analysis from Check Point Research traced the operation to a Rust-based clipboard hijacker, a “clipper” that swaps copied crypto wallet addresses for the attacker’s own, built for both Windows and macOS.

The lures are “edge” tools that promise easy money, crypto sniper bots and “predictors” that claim to forecast crash-gambling games, aimed at traders and gamblers chasing shortcuts. A WordPress phishing page acts as the hub, funneling victims to the downloads.

Manufacturing Trust

The campaign stands out for the effort it…