Known malicious kitcriticalmalware
Crypto clipper appended to jQuery and app scripts on fake investment, task and exchange sites
family: web-crypto-clipper-rca-2026-11
Short link:scanmalware.com/h/353
A clipboard hijacker added to the end of otherwise unmodified JavaScript files, most often jQuery 1.11.3, on fraudulent investment, "VIP" task and cryptocurrency exchange sites. When a visitor copies text from the page that contains a TRON, Ethereum or Bitcoin address, the script writes a different address to the clipboard, so a payment sent with the pasted address goes to the attacker's wallet. A MutationObserver re-arms it whenever the page changes. A later version picks the replacement at random from a pool of five wallets per chain. The same code appears on several unrelated scam-site templates (brand-themed "VIP" task platforms imitating Samsung, Dunlop, Mikimoto, Garmin and others, fake exchanges, mobile order-grabbing apps), each with its own wallets. A match means the page loaded a script carrying this clipper.
Anchors
Hunting ruleWeb_Crypto_Clipper_Copy_Hijack
SMQL queryrun
js_sha256:362e3bafe3a2a78800b995167e841b149de7bc89fbcb567851034f6b4be73b9b OR js_sha256:0326aecf3f1ae7bc00da31d4919f9de146963895647e3b40cd0ed77da9b8d6fe OR contacted_host:samsung2026.sbs OR contacted_host:ssamsung1.xyz OR contacted_host:samsung2026.lol OR contacted_host:ssamsung.lol OR contacted_host:samsung.beer OR contacted_host:ppa-energy.work OR contacted_host:lime-s.club OR contacted_host:mininginvestment.xyz OR contacted_host:mikimoto.asia OR contacted_host:a-guci.top OR contacted_host:dule.wang OR contacted_host:dunlop-ya.top OR contacted_host:epicvip.top OR contacted_host:dule-vip.topProvenance
Added: 2026-11-08 19:01
The main hunting rule keys on the clipper's structure (a copy-event handler that tests the selection against wallet-address patterns and writes a replacement with clipboardData.setData), not on wallets, function names or hosts, so it also matches new wallet sets. The hosts and the file hashes in the search query are a tracking aid only. Known hosts as of 2026-11-08 include samsung2026[.]sbs, ssamsung1[.]xyz, samsung2026[.]lol, ssamsung[.]lol, samsung[.]beer, ppa-energy[.]work, lime-s[.]club, mininginvestment[.]xyz, mikimoto[.]asia, a-guci[.]top, dule[.]wang, dunlop-ya[.]top, epicvip[.]top and dule-vip[.]top. Replacement wallets in the reported jQuery file: TRON TKxHKGtGY6J1XHFTtvwYEiaQmVx4Wb6c2i, Ethereum 0x25d4e937d65c7af9dab5224dcc3340ca8718fba5, Bitcoin 1NqsyzYsZ26zWkHxkoRKrbZo2KGwDgFahk, 39oQi4nN9CSigKSUp9imbXKnEXd8zkSJhs and bc1q4tl5hrvj4ua5xdecsg5uy6uvxt3cww7jrz2tuk; other copies use other wallets. The earliest copies seen date from December 2025.
Sightings (89)Atom feed
| Host | Scan | Script | Match | Scanned |
|---|---|---|---|---|
| ssamsung.lol | 1263d03e… | — | query | 2026-11-09 07:47 |
| samsung2026.lol | e718e8b8… | — | query | 2026-11-08 19:14 |
| dule-vip.top | eca7bfab… | https://dule-vip.top/static/home/js/jquery-1.11.3.min.js | rule | 2026-11-08 17:51 |
| dule-vip.top | eca7bfab… | — | query | 2026-11-08 17:51 |
| samsung.beer | 7ca5d8f6… | — | query | 2026-11-08 17:51 |
| lime-s.club | 3c8dac9d… | — | query | 2026-11-08 17:51 |
| dunlop-ya.top | e8cc6fce… | https://dunlop-ya.top/static/home/js/jquery-1.11.3.min.js | rule | 2026-11-08 17:51 |
| dunlop-ya.top | e8cc6fce… | — | query | 2026-11-08 17:51 |
| dule.wang | eaf519d3… | https://dule.wang/static/home/js/jquery-1.11.3.min.js | rule | 2026-11-08 17:51 |
| dule.wang | eaf519d3… | https://dule.wang/static/home/js/jquery-weui.min.js | rule | 2026-11-08 17:51 |
| dule.wang | eaf519d3… | — | query | 2026-11-08 17:51 |
| a-guci.top | cd623069… | https://a-guci.top/static/home/js/jquery-1.11.3.min.js | rule | 2026-11-08 17:51 |
| a-guci.top | cd623069… | https://a-guci.top/static/home/js/jquery-weui.min.js | rule | 2026-11-08 17:51 |
| a-guci.top | cd623069… | — | query | 2026-11-08 17:51 |
| ssamsung1.xyz | 66d41a53… | https://ssamsung1.xyz/static/home/js/jquery-1.11.3.min.js | rule | 2026-11-08 17:51 |
| ssamsung1.xyz | 66d41a53… | — | query | 2026-11-08 17:51 |
| samsung2026.sbs | 7b48730f… | https://samsung2026.sbs/static/home/js/jquery-1.11.3.min.js | rule | 2026-11-08 17:51 |
| samsung2026.sbs | 7b48730f… | — | query | 2026-11-08 17:51 |
| dunlop-ya.top | af955197… | https://dunlop-ya.top/static/home/js/jquery-1.11.3.min.js | rule | 2026-11-08 17:47 |
| dunlop-ya.top | af955197… | — | query | 2026-11-08 17:47 |
| samsung2026.lol | 0bb7ba2a… | — | query | 2026-11-08 16:47 |
| samsung2026.sbs | 5415198f… | https://samsung2026.sbs/static/home/js/jquery-1.11.3.min.js | rule | 2026-11-08 15:47 |
| samsung2026.sbs | 5415198f… | — | query | 2026-11-08 15:47 |
| ssamsung1.xyz | 601b482a… | https://ssamsung1.xyz/static/home/js/jquery-1.11.3.min.js | rule | 2026-11-08 14:47 |
| ssamsung1.xyz | 601b482a… | — | query | 2026-11-08 14:47 |
| epicvip.top | 75868f4b… | https://epicvip.top/static/home/js/jquery-1.11.3.min.js | rule | 2026-11-08 13:47 |
| epicvip.top | 75868f4b… | — | query | 2026-11-08 13:47 |
| mikimoto.asia | ee6832a0… | https://mikimoto.asia/static/home/js/jquery-weui.min.js | rule | 2026-11-05 21:20 |
| mikimoto.asia | ee6832a0… | https://mikimoto.asia/static/home/js/jquery-1.11.3.min.js | rule | 2026-11-05 21:20 |
| mikimoto.asia | ee6832a0… | — | query | 2026-11-05 21:20 |
| kef-yi.top | ebb12720… | https://kef-yi.top/static/home/js/jquery-weui.min.js | rule | 2026-09-21 15:01 |
| kef-yi.top | ebb12720… | https://kef-yi.top/static/home/js/jquery-1.11.3.min.js | rule | 2026-09-21 15:01 |
| kef-yi.top | ebb12720… | — | query | 2026-09-21 15:01 |
| mininginvestment.xyz | f4d4b107… | https://mininginvestment.xyz/static/home/js/jquery-1.11.3.min.js | rule | 2026-08-10 02:22 |
| mininginvestment.xyz | f4d4b107… | — | query | 2026-08-10 02:22 |
| garminfcoo.top | bf2dce41… | https://garminfcoo.top/static/home/js/jquery-1.11.3.min.js | rule | 2026-07-27 07:56 |
| garminfcoo.top | bf2dce41… | https://garminfcoo.top/static/home/js/jquery-weui.min.js | rule | 2026-07-27 07:56 |
| garminfcoo.top | bf2dce41… | — | query | 2026-07-27 07:56 |
| jucoin-trade.top | cc2c0afe… | https://jucoin-trade.top/Public/Static/slider/jquery.js | rule | 2026-04-22 07:19 |
| jucoin-trade.top | 80d255de… | https://jucoin-trade.top/Public/Static/slider/jquery.js | rule | 2026-04-20 17:53 |
| jucoin-trade.top | 37df19aa… | https://jucoin-trade.top/Public/Static/slider/jquery.js | rule | 2026-04-19 04:09 |
| jucoin-trade.top | 2c6453d4… | https://jucoin-trade.top/Public/Static/slider/jquery.js | rule | 2026-04-17 12:48 |
| jucoin-trade.top | d4c3ede8… | http://jucoin-trade.top/Public/Static/slider/jquery.js | rule | 2026-04-17 03:48 |
| iusdcoin.ink | 6cd4b899… | https://iusdcoin.ink/Public/Static/js/jquery.min.js | rule | 2026-04-08 15:52 |
| iusdcoin.ink | 6cd4b899… | — | query | 2026-04-08 15:52 |
| iusdcoin.world | fcb85dde… | https://iusdcoin.world/Public/Static/js/jquery.min.js | rule | 2026-04-07 16:11 |
| iusdcoin.world | fcb85dde… | — | query | 2026-04-07 16:11 |
| iusdcoin.xyz | 2c540844… | https://iusdcoin.xyz/Public/Static/js/jquery.min.js | rule | 2026-04-03 20:52 |
| iusdcoin.xyz | 2c540844… | — | query | 2026-04-03 20:52 |
| ghforobq.click | 0273f47e… | https://ghforobq.click/static/js/pages-login-index.3ddc33c6.js | rule | 2026-04-03 01:05 |
| ghforobq.click | 0273f47e… | https://ghforobq.click/static/js/pages-index-bid_orders-index~pages-index-index~pages-my-account-balance-index~pages-my-account-login~6a36a1e8.2595d8a9.js | rule | 2026-04-03 01:05 |
| ghforobq.click | 0273f47e… | https://ghforobq.click/static/js/pages-index-index.dc525085.js | rule | 2026-04-03 01:05 |
| ghforobq.click | 0273f47e… | https://ghforobq.click/static/js/pages-index-bid_orders-index~pages-index-index~pages-my-account-balance-index~pages-my-account-recha~a3ba5c73.5c2aa89b.js | rule | 2026-04-03 01:05 |
| ghforobq.click | 0273f47e… | https://ghforobq.click/static/js/pages-index-bid_orders-index~pages-index-index~pages-login-index~pages-login-register-index~pages-my~901a01b0.028c940a.js | rule | 2026-04-03 01:05 |
| ghforobq.click | 0273f47e… | https://ghforobq.click/static/js/index.16f3a025.js | rule | 2026-04-03 01:05 |
| mo1e1.top | 8956fca4… | https://mo1e1.top/mobile/static/js/pages-index-index.eab6178e.js | rule | 2026-04-01 16:27 |
| mo1e1.top | 8956fca4… | https://mo1e1.top/mobile/static/js/pages-index-index~pages-order-order~pages-user-user.99cdbc99.js | rule | 2026-04-01 16:27 |
| mo1e1.top | 8956fca4… | https://mo1e1.top/mobile/static/js/index.377e7bd4.js | rule | 2026-04-01 16:27 |
| mo1e1.top | a1bc204f… | https://mo1e1.top/mobile/static/js/pages-index-index.eab6178e.js | rule | 2026-03-30 20:07 |
| mo1e1.top | a1bc204f… | https://mo1e1.top/mobile/static/js/pages-index-index~pages-order-order~pages-user-user.99cdbc99.js | rule | 2026-03-30 20:07 |
| mo1e1.top | a1bc204f… | https://mo1e1.top/mobile/static/js/index.377e7bd4.js | rule | 2026-03-30 20:07 |
| vvniyaqz.click | 127c15b8… | https://vvniyaqz.click/static/js/pages-login-index.70937249.js | rule | 2026-03-28 14:25 |
| vvniyaqz.click | 127c15b8… | https://vvniyaqz.click/static/js/pages-index-bid_orders-index~pages-login-index~pages-login-register-index~pages-my-account-balance-i~2a47be03.5484b06d.js | rule | 2026-03-28 14:25 |
| vvniyaqz.click | 127c15b8… | https://vvniyaqz.click/static/js/pages-login-index~pages-login-register-index~pages-my-account-login-psd-index~pages-my-account-pay-psd-index.af01e7d4.js | rule | 2026-03-28 14:25 |
| vvniyaqz.click | 127c15b8… | https://vvniyaqz.click/static/js/pages-index-bid_orders-index~pages-index-index~pages-my-account-balance-index~pages-my-account-login~6a36a1e8.a31023dc.js | rule | 2026-03-28 14:25 |
| vvniyaqz.click | 127c15b8… | https://vvniyaqz.click/static/js/pages-index-bid_orders-index~pages-index-index~pages-my-account-balance-index~pages-my-account-recha~a3ba5c73.495d8869.js | rule | 2026-03-28 14:25 |
| vvniyaqz.click | 127c15b8… | https://vvniyaqz.click/static/js/pages-index-bid_orders-index~pages-index-index~pages-my-account-balance-index~pages-my-account-recha~c80fbe36.aa7ff9eb.js | rule | 2026-03-28 14:25 |
| vvniyaqz.click | 127c15b8… | https://vvniyaqz.click/static/js/pages-index-index.c62f95a2.js | rule | 2026-03-28 14:25 |
| vvniyaqz.click | 127c15b8… | https://vvniyaqz.click/static/js/index.c83008ae.js | rule | 2026-03-28 14:25 |
| onpckmyo.click | 70d463be… | https://onpckmyo.click/static/js/pages-login-index.f40ea74e.js | rule | 2026-03-27 15:29 |
| onpckmyo.click | 70d463be… | https://onpckmyo.click/static/js/pages-index-bid_orders-index~pages-index-index~pages-my-account-balance-index~pages-my-account-recha~a3ba5c73.b8d45aff.js | rule | 2026-03-27 15:29 |
| onpckmyo.click | 70d463be… | https://onpckmyo.click/static/js/pages-index-bid_orders-index~pages-index-index~pages-my-account-balance-index~pages-my-account-login~6a36a1e8.64f37be1.js | rule | 2026-03-27 15:29 |
| onpckmyo.click | 70d463be… | https://onpckmyo.click/static/js/pages-index-index.e8f7e38a.js | rule | 2026-03-27 15:29 |
| onpckmyo.click | 70d463be… | https://onpckmyo.click/static/js/pages-index-bid_orders-index~pages-index-index~pages-login-index~pages-login-register-index~pages-my~901a01b0.e5c689e0.js | rule | 2026-03-27 15:29 |
| onpckmyo.click | 70d463be… | https://onpckmyo.click/static/js/index.937c1063.js | rule | 2026-03-27 15:29 |
| hkgtgj.top | 0e9171b6… | https://hkgtgj.top/h5/static/js/index.17b59011.js | rule | 2026-03-27 04:07 |
| hkgtgj.top | 7ff4699a… | https://hkgtgj.top/h5/static/js/index.17b59011.js | rule | 2026-03-23 03:39 |
| baseonlinez.com | 10aa871d… | https://baseonlinez.com/assets/index-af9ecd62.js | rule | 2026-03-16 16:42 |
| app-tkasiashop.top | b09f7b48… | https://app-tkasiashop.top/static/js/jquery-3.6.0.js | rule | 2026-03-01 04:53 |
| app-tkasiashop.top | b09f7b48… | https://app-tkasiashop.top/static/js/jquery.min.js | rule | 2026-03-01 04:53 |
| app-tkasiashop.top | b09f7b48… | https://app-tkasiashop.top/static/js/jquery02.js | rule | 2026-03-01 04:53 |
| app-tkasiashop.top | b09f7b48… | https://app-tkasiashop.top/static/js/jquery-numerator.js | rule | 2026-03-01 04:53 |
| xcwqkcuy.click | 50444c48… | https://xcwqkcuy.click/static/js/index.99333deb.js | rule | 2026-01-13 16:14 |
| btbuu.com | 801bdf96… | https://btbuu.com/Public/js/jquery.min.js | rule | 2026-01-03 12:56 |
| btbuu.com | 019f52d9… | https://btbuu.com/Public/js/jquery.min.js | rule | 2026-01-03 12:07 |
| btbuu.com | d0a528bf… | https://btbuu.com/Public/js/jquery.min.js | rule | 2026-01-03 02:29 |
| btbuu.com | 82af296c… | https://btbuu.com/Public/js/jquery.min.js | rule | 2026-01-02 06:25 |
| btbuu.com | 992522e5… | https://btbuu.com/Public/js/jquery.min.js | rule | 2025-12-30 01:04 |
| btbuu.com | be2adbd5… | https://btbuu.com/Public/js/jquery.min.js | rule | 2025-12-29 23:46 |