Piracy Pitfalls: MassJacker Malware Quietly Drains Cryptocurrency Wallets

Summary

• MassJacker Malware: A clipboard-hijacking campaign, discovered by CyberArk, that steals cryptocurrency by swapping wallet addresses.
• Infiltration Tactics: It spreads through pesktop[.]com, a site that hosts pirated software and malware.
• Scale: CyberArk found at least 778,531 attacker wallet addresses; about 423 held $95,300 at the time of analysis.
• Prevention and Defense: Avoid pirated software and double-check wallet addresses before sending crypto.

How MassJacker Was Found

Security firm CyberArk has uncovered a cryptocurrency theft operation it calls MassJacker, BleepingComputer reported in March 2025. It’s a “clipper.” It watches the Windows clipboard for copied cryptocurrency wallet addresses and replaces them with addresses the attackers control. Victims who paste an address to send money end up paying the attackers instead.

Clippers are simple. They also work, and because they do one small thing and nothing else, antivirus tools and wary users often miss them for a long time. MassJacker targets people looking for free software, spreading through pesktop[.]com, a site that hosts pirated software and malware.

Inside the Infection Chain

Installers downloaded from the site run a cmd script that triggers a PowerShell script. That script fetches an Amadey bot and two loader files, PackerE and PackerD1. Amadey runs PackerE. PackerE loads PackerD1.

PackerD1 is built to evade analysis, using tricks such as Just-In-Time (JIT) hooking and a custom virtual machine for running commands. It decrypts and injects PackerD2, which extracts the final MassJacker payload and injects it into the legitimate Windows process InstalUtil.exe. From there, MassJacker uses regex patterns to spot wallet addresses on the clipboard and swaps in one from an encrypted list.

How Much Was Stolen

CyberArk found at least 778,531 unique wallet addresses tied to the campaign. About 423 of them held $95,300 at the time of analysis, though historical data points to larger transactions. A single Solana wallet that appears to act as a central collection point has received over $300,000 in transactions.

CyberArk suspects one threat group runs the whole operation, because file names and encryption keys were consistent across the campaign. It could still be a malware-as-a-service setup in which one administrator sells access to other criminals.

How to Protect Yourself

Skip pirated software. Sites that offer free versions of paid programs are a common way to deliver malware.

Also check the full wallet address after pasting it and before confirming any transaction. Up-to-date endpoint protection can catch known loaders like Amadey.

CyberArk has urged researchers to look more closely at large clipper operations like MassJacker. Even when the losses seem small, they can reveal useful details about the people behind them.

The Takeaway

MassJacker shows how much damage a low-tech trick can do at scale. One swapped string is enough.

Anyone who handles cryptocurrency should treat every pasted address with suspicion and avoid sites that offer cracked software.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.