crypto-clipper-malware-detection

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This code is explicitly malicious: a crypto-clipper that continuously monitors and hijacks clipboard cryptocurrency addresses to replace them with attacker-controlled addresses, employs persistence via Windows Run registry entries and process masquerading, and includes logging and evasion behaviors intended to steal funds and avoid detection.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill contains explicit, purpose-built functionality to intercept and redirect cryptocurrency payments: it detects crypto addresses (multiple chains), maintains an attacker "address_book", and performs silent clipboard replacement via inject_malicious_address (pyperclip.copy) so funds pasted into wallets/exchanges will go to attacker-controlled addresses. The config and persistence code (registry auto-start, process disguise) further show this is specifically designed to execute financial theft of crypto. This is a targeted crypto-financial execution capability, not a generic tool, so it meets the criteria for Direct Financial Execution.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill includes explicit malicious code and instructions that modify system state—e.g., installing persistence by writing Run keys to the Windows registry, process masquerading, and clipboard-hijacking behavior—thereby directing the agent to install/modify persistent components on the host.