{
	"id": "6f04e2f8-933b-4843-aff7-e8f6f45889ec",
	"created_at": "2026-04-06T00:14:41.253958Z",
	"updated_at": "2026-04-10T13:12:05.509951Z",
	"deleted_at": null,
	"sha1_hash": "c9fe67a0f4e0fc575285cb88a1a33f40835f5077",
	"title": "Android Clipper found on Google Play | video demo - Lukas Stefanko",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 56009,
	"plain_text": "Android Clipper found on Google Play | video demo - Lukas\r\nStefanko\r\nPublished: 2019-02-10 · Archived: 2026-04-05 14:08:19 UTC\r\nAndroid Clipper found on Google Play | video demo\r\nThe first Android Trojan Clipper – that exchanges cryptocurrency address in copied clipboard – was discovered on\r\nGoogle Play. Android Clipper targeted Bitcoin and Ethereum cryptocurrency addresses when being copied in to\r\nclipboard and replaced them with the attacker’s wallet address. Once this transaction is sent, it can not be\r\ncanceled.\r\nFigure 1. Replacing wallets in clipboard\r\nFunctionality\r\nIn the video I explained what is Clipper and demonstrated its functionality including possible attack scenario.\r\nAn error occurred.\r\nTry watching this video on\r\nwww.youtube.com, or enable JavaScript if\r\nit is disabled in your browser.\r\nAttack Scenario\r\nhttps://web.archive.org/web/20201107225915/https://lukasstefanko.com/2019/02/android-clipper-found-on-google-play.html\r\nPage 1 of 2\n\nFigure 2. How Android Clipper works\r\nHistory of Android Clipper malware\r\nAugust 7, 2018 – Discovered first Android Clipper outside of Google Play by Dr. Web\r\nFebruary 8, 2019 – Discovered first Android Clipper in Google Play by ESET\r\nSample\r\nI test Android malware, so you don’t have to. Be Aware, Be Secure!\r\nSource: https://web.archive.org/web/20201107225915/https://lukasstefanko.com/2019/02/android-clipper-found-on-google-play.html\r\nhttps://web.archive.org/web/20201107225915/https://lukasstefanko.com/2019/02/android-clipper-found-on-google-play.html\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://web.archive.org/web/20201107225915/https://lukasstefanko.com/2019/02/android-clipper-found-on-google-play.html"
	],
	"report_names": [
		"android-clipper-found-on-google-play.html"
	],
	"threat_actors": [
		{
			"id": "75108fc1-7f6a-450e-b024-10284f3f62bb",
			"created_at": "2024-11-01T02:00:52.756877Z",
			"updated_at": "2026-04-10T02:00:05.273746Z",
			"deleted_at": null,
			"main_name": "Play",
			"aliases": null,
			"source_name": "MITRE:Play",
			"tools": [
				"Nltest",
				"AdFind",
				"PsExec",
				"Wevtutil",
				"Cobalt Strike",
				"Playcrypt",
				"Mimikatz"
			],
			"source_id": "MITRE",
			"reports": null
		}
	],
	"ts_created_at": 1775434481,
	"ts_updated_at": 1775826725,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/c9fe67a0f4e0fc575285cb88a1a33f40835f5077.pdf",
		"text": "https://archive.orkl.eu/c9fe67a0f4e0fc575285cb88a1a33f40835f5077.txt",
		"img": "https://archive.orkl.eu/c9fe67a0f4e0fc575285cb88a1a33f40835f5077.jpg"
	}
}