From Stars to Upvotes: The Fake Reputation Economy Behind Crypto Clipboard Hijackers
Check Point, Wednesday, June 17th, 2026
Check Point Research exposes a crypto clipboard hijacker promoted through a cross-platform fake reputation economy.
Check Point Research analyzed a cryptocurrency clipboard hijacker hidden inside Solana and Pump.fun sniper bot tools, distributed by a single threat actor running a cross-platform ecosystem of a WordPress phishing hub, GitHub and SourceForge projects, a YouTube channel, and crypto forums.
The actor seeded benign votes and safe comments on VirusTotal samples to nudge reputation-based defenses toward misclassifying malicious files. AI-generated tutorial videos, inflated download counts, and coordinated five-star reviews built a fake reputation economy targeting crypto holders.