{
 "tag": "windows",
 "name": "Windows",
 "group": "Platforms & channels",
 "incidents": [
  {
   "slug": "silent-swap-fake-google-notes-clipper-extension-jun-2026",
   "title": "'Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses",
   "url": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026",
   "json": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "ethereum",
    "solana"
   ],
   "method": "clipboard-hijacker",
   "product": "Chromium browser users infected via unsigned installers (fake 'Google Notes' extension)",
   "tags": [
    "bitcoin",
    "ethereum",
    "solana",
    "clipboard-hijacker",
    "clipper",
    "browser-extension",
    "chrome",
    "chromium",
    "countloader",
    "mcafee",
    "etherhiding",
    "windows"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-06-30",
   "closedAt": "2026-06-30",
   "updatedAt": "2026-06-30T12:00:00Z",
   "summary": "McAfee researchers found unsigned .NET and Go installers, linked to the CountLoader malware loader, that force-install a fake 'Google Notes' extension into Chromium browsers. The extension reads the clipboard and replaces copied Bitcoin, Ethereum, Bitcoin Cash, XRP, Dash and Solana addresses with attacker addresses; it finds its control server through a smart contract. Anyone who finds an unknown 'Google Notes' extension should remove it and treat anything copied while it was installed as exposed. No loss total was published."
  },
  {
   "slug": "cryptobandits-usb-worm-clipper-tor-jun-2026",
   "title": "Microsoft: USB-spread 'CryptoBandits' clipper swaps wallet addresses and steals seed phrases over Tor",
   "url": "https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026",
   "json": "https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "ethereum",
    "tron"
   ],
   "method": "clipboard-hijacker",
   "product": "Windows users who open shortcut files from USB drives",
   "tags": [
    "bitcoin",
    "ethereum",
    "tron",
    "clipboard-hijacker",
    "windows",
    "clipper",
    "usb-worm",
    "lnk",
    "tor",
    "microsoft",
    "cryptobandits",
    "seed-phrase"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-06-17",
   "closedAt": "2026-06-18",
   "updatedAt": "2026-06-18T12:00:00Z",
   "summary": "Microsoft reported a Windows crypto clipper, detected as Trojan:Win32/CryptoBandits, active since February 2026 and spreading through malicious shortcut (.lnk) files on USB drives. It checks the clipboard every half second, replaces copied Bitcoin, Tron and Monero addresses with lookalikes that share the first characters, grabs copied 12/24-word seed phrases and private keys, takes screenshots, and talks to its servers over Tor. Always check the whole address on your wallet or device screen before sending. No loss total was published."
  }
 ],
 "changes": [
  {
   "incident": "silent-swap-fake-google-notes-clipper-extension-jun-2026",
   "incidentTitle": "'Silent Swap' clipper hides in a fake Google Notes browser extension to swap wallet addresses",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-06-30",
   "title": "eSecurity Planet reports McAfee's findings on the Silent Swap clipper extension campaign.",
   "sourceUrl": "https://www.esecurityplanet.com/threats/silent-swap-uses-fake-chrome-extension-to-steal-crypto/",
   "url": "https://drains.watch/i/silent-swap-fake-google-notes-clipper-extension-jun-2026"
  },
  {
   "incident": "cryptobandits-usb-worm-clipper-tor-jun-2026",
   "incidentTitle": "Microsoft: USB-spread 'CryptoBandits' clipper swaps wallet addresses and steals seed phrases over Tor",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-06-18",
   "title": "BleepingComputer reports the USB worm clipper and its address-swap and seed-phrase theft.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/usb-worm-spreads-crypto-stealing-malware-via-windows-shortcut-files/",
   "url": "https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026"
  },
  {
   "incident": "cryptobandits-usb-worm-clipper-tor-jun-2026",
   "incidentTitle": "Microsoft: USB-spread 'CryptoBandits' clipper swaps wallet addresses and steals seed phrases over Tor",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-06-17",
   "title": "Microsoft Threat Intelligence details the Tor-based crypto clipper with worm-like USB spreading, active since February 2026.",
   "sourceUrl": "https://www.microsoft.com/en-us/security/blog/?p=148177",
   "url": "https://drains.watch/i/cryptobandits-usb-worm-clipper-tor-jun-2026"
  }
 ]
}