Windows
2 incidents, 0 live. 114 days since the last new one.
2 drains in the last 12 months
2 drains in the last 12 months
2 drains in 2026
Past
June 2026 2
-
Medium✕Still active
'Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses
McAfee researchers found unsigned .NET and Go installers, linked to the CountLoader malware loader, that force-install a fake 'Google Notes' extension into Chromium browsers. The extension reads the clipboard and replaces copied Bitcoin, Ethereum, Bitcoin Cash, XRP, Dash and Solana addresses with attacker addresses; it finds its control server through a smart contract. Anyone who finds an unknown 'Google Notes' extension should remove it and treat anything copied while it was installed as exposed. No loss total was published.
Chromium browser users infected via unsigned installers (fake 'Google Notes' extension)·Bitcoin, Ethereum, Solana·Since Jun 30, 2026·
-
High✕Still active
Microsoft: USB-spread 'CryptoBandits' clipper swaps wallet addresses and steals seed phrases over Tor
Microsoft reported a Windows crypto clipper, detected as Trojan:Win32/CryptoBandits, active since February 2026 and spreading through malicious shortcut (.lnk) files on USB drives. It checks the clipboard every half second, replaces copied Bitcoin, Tron and Monero addresses with lookalikes that share the first characters, grabs copied 12/24-word seed phrases and private keys, takes screenshots, and talks to its servers over Tor. Always check the whole address on your wallet or device screen before sending. No loss total was published.
Windows users who open shortcut files from USB drives·Bitcoin, Ethereum, Tron·Since Jun 17, 2026·
No drains match these filters.