#clipboard — Public Fediverse posts

UniClipboard is an open-source clipboard sync tool for securely sharing text, images, and files across your devices.

It uses end-to-end encryption, works on Windows, macOS, Linux, Android, and iOS, and doesn't require a cloud account.

More details: https://digitalescapetools.com/tools/tool.html?id=uniclipboard

#OpenSource #Privacy #Productivity #Clipboard #Windows #Linux #macOS #Android #iOS

UniClipboard is an open-source clipboard sync tool for securely sharing text, images, and files across your devices.

It uses end-to-end encryption, works on Windows, macOS, Linux, Android, and iOS, and doesn't require a cloud account.

More details: https://digitalescapetools.com/tools/tool.html?id=uniclipboard

#OpenSource #Privacy #Productivity #Clipboard #Windows #Linux #macOS #Android #iOS

UniClipboard is an open-source clipboard sync tool for securely sharing text, images, and files across your devices.

It uses end-to-end encryption, works on Windows, macOS, Linux, Android, and iOS, and doesn't require a cloud account.

More details: https://digitalescapetools.com/tools/tool.html?id=uniclipboard

#OpenSource #Privacy #Productivity #Clipboard #Windows #Linux #macOS #Android #iOS

UniClipboard is an open-source clipboard sync tool for securely sharing text, images, and files across your devices.

It uses end-to-end encryption, works on Windows, macOS, Linux, Android, and iOS, and doesn't require a cloud account.

More details: https://digitalescapetools.com/tools/tool.html?id=uniclipboard

#OpenSource #Privacy #Productivity #Clipboard #Windows #Linux #macOS #Android #iOS

UniClipboard is an open-source clipboard sync tool for securely sharing text, images, and files across your devices.

It uses end-to-end encryption, works on Windows, macOS, Linux, Android, and iOS, and doesn't require a cloud account.

More details: https://digitalescapetools.com/tools/tool.html?id=uniclipboard

#OpenSource #Privacy #Productivity #Clipboard #Windows #Linux #macOS #Android #iOS

CopyQ: il superpotere #OpenSource che manca alla tua #Clipboard
#software #windows #linux #macos @opensource

https://webappsmagazine.blogspot.com/2026/07/copyq-il-superpotere-open-source-che.html

CopyQ: il superpotere #OpenSource che manca alla tua #Clipboard
#software #windows #linux #macos @opensource

https://webappsmagazine.blogspot.com/2026/07/copyq-il-superpotere-open-source-che.html

Contagious Interview malware in SVG images: DPRK campaign

A DPRK-aligned threat group is targeting developers through fake job postings and coding challenges in a campaign tracked as REF9403. Attackers post fake job offers in developer forums, then send trojanized repositories containing fully functional e-commerce projects with malicious code hidden using steganography inside SVG flag images. When developers run these projects, the malware deploys four-stage payloads aligned with OTTERCOOKIE: a browser credential and cryptocurrency wallet stealer, a file exfiltration module, a Socket.IO-based remote access trojan, and a clipboard stealer. The campaign was discovered after targeting Elastic's community Slack workspace. Multiple trojanized repositories were found with zero antivirus detections at the time of discovery, demonstrating the sophistication of this supply chain attack vector against software developers.

Pulse ID: 6a5a8ba0229db5a5b2686baa
Pulse Link: https://otx.alienvault.com/pulse/6a5a8ba0229db5a5b2686baa
Pulse Author: AlienVault
Created: 2026-07-17 20:08:00

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #Clipboard #CyberSecurity #DPRK #InfoSec #Malware #OTX #OpenThreatExchange #RAT #RCE #RemoteAccessTrojan #SVG #Steganography #SupplyChain #Trojan #bot #cryptocurrency #developers #AlienVault

Contagious Interview malware in SVG images: DPRK campaign

A DPRK-aligned threat group is targeting developers through fake job postings and coding challenges in a campaign tracked as REF9403. Attackers post fake job offers in developer forums, then send trojanized repositories containing fully functional e-commerce projects with malicious code hidden using steganography inside SVG flag images. When developers run these projects, the malware deploys four-stage payloads aligned with OTTERCOOKIE: a browser credential and cryptocurrency wallet stealer, a file exfiltration module, a Socket.IO-based remote access trojan, and a clipboard stealer. The campaign was discovered after targeting Elastic's community Slack workspace. Multiple trojanized repositories were found with zero antivirus detections at the time of discovery, demonstrating the sophistication of this supply chain attack vector against software developers.

Pulse ID: 6a5a8ba0229db5a5b2686baa
Pulse Link: https://otx.alienvault.com/pulse/6a5a8ba0229db5a5b2686baa
Pulse Author: AlienVault
Created: 2026-07-17 20:08:00

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #Clipboard #CyberSecurity #DPRK #InfoSec #Malware #OTX #OpenThreatExchange #RAT #RCE #RemoteAccessTrojan #SVG #Steganography #SupplyChain #Trojan #bot #cryptocurrency #developers #AlienVault

Contagious Interview malware in SVG images: DPRK campaign

A DPRK-aligned threat group is targeting developers through fake job postings and coding challenges in a campaign tracked as REF9403. Attackers post fake job offers in developer forums, then send trojanized repositories containing fully functional e-commerce projects with malicious code hidden using steganography inside SVG flag images. When developers run these projects, the malware deploys four-stage payloads aligned with OTTERCOOKIE: a browser credential and cryptocurrency wallet stealer, a file exfiltration module, a Socket.IO-based remote access trojan, and a clipboard stealer. The campaign was discovered after targeting Elastic's community Slack workspace. Multiple trojanized repositories were found with zero antivirus detections at the time of discovery, demonstrating the sophistication of this supply chain attack vector against software developers.

Pulse ID: 6a5a8ba0229db5a5b2686baa
Pulse Link: https://otx.alienvault.com/pulse/6a5a8ba0229db5a5b2686baa
Pulse Author: AlienVault
Created: 2026-07-17 20:08:00

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #Clipboard #CyberSecurity #DPRK #InfoSec #Malware #OTX #OpenThreatExchange #RAT #RCE #RemoteAccessTrojan #SVG #Steganography #SupplyChain #Trojan #bot #cryptocurrency #developers #AlienVault

Contagious Interview malware in SVG images: DPRK campaign

A DPRK-aligned threat group is targeting developers through fake job postings and coding challenges in a campaign tracked as REF9403. Attackers post fake job offers in developer forums, then send trojanized repositories containing fully functional e-commerce projects with malicious code hidden using steganography inside SVG flag images. When developers run these projects, the malware deploys four-stage payloads aligned with OTTERCOOKIE: a browser credential and cryptocurrency wallet stealer, a file exfiltration module, a Socket.IO-based remote access trojan, and a clipboard stealer. The campaign was discovered after targeting Elastic's community Slack workspace. Multiple trojanized repositories were found with zero antivirus detections at the time of discovery, demonstrating the sophistication of this supply chain attack vector against software developers.

Pulse ID: 6a5a8ba0229db5a5b2686baa
Pulse Link: https://otx.alienvault.com/pulse/6a5a8ba0229db5a5b2686baa
Pulse Author: AlienVault
Created: 2026-07-17 20:08:00

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #Clipboard #CyberSecurity #DPRK #InfoSec #Malware #OTX #OpenThreatExchange #RAT #RCE #RemoteAccessTrojan #SVG #Steganography #SupplyChain #Trojan #bot #cryptocurrency #developers #AlienVault

Contagious Interview malware in SVG images: DPRK campaign

A DPRK-aligned threat group is targeting developers through fake job postings and coding challenges in a campaign tracked as REF9403. Attackers post fake job offers in developer forums, then send trojanized repositories containing fully functional e-commerce projects with malicious code hidden using steganography inside SVG flag images. When developers run these projects, the malware deploys four-stage payloads aligned with OTTERCOOKIE: a browser credential and cryptocurrency wallet stealer, a file exfiltration module, a Socket.IO-based remote access trojan, and a clipboard stealer. The campaign was discovered after targeting Elastic's community Slack workspace. Multiple trojanized repositories were found with zero antivirus detections at the time of discovery, demonstrating the sophistication of this supply chain attack vector against software developers.

Pulse ID: 6a5a8ba0229db5a5b2686baa
Pulse Link: https://otx.alienvault.com/pulse/6a5a8ba0229db5a5b2686baa
Pulse Author: AlienVault
Created: 2026-07-17 20:08:00

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #Clipboard #CyberSecurity #DPRK #InfoSec #Malware #OTX #OpenThreatExchange #RAT #RCE #RemoteAccessTrojan #SVG #Steganography #SupplyChain #Trojan #bot #cryptocurrency #developers #AlienVault

Link to Pane: буфер обмена Mac Android через протокол Microsoft (потому что иначе — pain (икра слов)

Привет, Хабр! Пришло время реверсить протоколы снова. Apple я делал. Google тоже. Угадайте какая компания следующая?

https://habr.com/ru/articles/1060248/

#phone_link #link_to_windows #clipboard #macos #reverse_engineering #microsoft #shareware

PamStealer: a Rust-based macOS infostealer that validates credentials through PAM

PamStealer is a two-stage macOS infostealer distributed as a compiled AppleScript impersonating Maccy, a legitimate clipboard manager, hosted on a fake domain. The first stage uses JavaScript for Automation with Objective-C APIs to download payloads while avoiding shell commands. The second stage is a Rust-based Mach-O binary that validates stolen credentials through PAM before harvesting, reads browser databases directly using bundled SQLite, captures clipboard contents repeatedly via pbpaste, and exfiltrates encrypted data using ChaCha20-Poly1305. It establishes persistence through both modern and legacy login item APIs, masquerades as Finder or System Settings, and tricks victims into granting Full Disk Access through counterfeit alerts. The stealer contacts Ethereum RPC endpoints and employs region-based exclusions targeting Apple silicon systems while avoiding Commonwealth of Independent States countries.

Pulse ID: 6a471de6cf9848f2ef9503c0
Pulse Link: https://otx.alienvault.com/pulse/6a471de6cf9848f2ef9503c0
Pulse Author: AlienVault
Created: 2026-07-03 02:26:46

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #ChaCha20 #Clipboard #CyberSecurity #Endpoint #InfoSec #InfoStealer #Java #JavaScript #Mac #MacOS #OTX #OpenThreatExchange #RAT #RPC #Rust #SQL #bot #AlienVault

PamStealer: a Rust-based macOS infostealer that validates credentials through PAM

PamStealer is a two-stage macOS infostealer distributed as a compiled AppleScript impersonating Maccy, a legitimate clipboard manager, hosted on a fake domain. The first stage uses JavaScript for Automation with Objective-C APIs to download payloads while avoiding shell commands. The second stage is a Rust-based Mach-O binary that validates stolen credentials through PAM before harvesting, reads browser databases directly using bundled SQLite, captures clipboard contents repeatedly via pbpaste, and exfiltrates encrypted data using ChaCha20-Poly1305. It establishes persistence through both modern and legacy login item APIs, masquerades as Finder or System Settings, and tricks victims into granting Full Disk Access through counterfeit alerts. The stealer contacts Ethereum RPC endpoints and employs region-based exclusions targeting Apple silicon systems while avoiding Commonwealth of Independent States countries.

Pulse ID: 6a471de6cf9848f2ef9503c0
Pulse Link: https://otx.alienvault.com/pulse/6a471de6cf9848f2ef9503c0
Pulse Author: AlienVault
Created: 2026-07-03 02:26:46

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #ChaCha20 #Clipboard #CyberSecurity #Endpoint #InfoSec #InfoStealer #Java #JavaScript #Mac #MacOS #OTX #OpenThreatExchange #RAT #RPC #Rust #SQL #bot #AlienVault

PamStealer: a Rust-based macOS infostealer that validates credentials through PAM

PamStealer is a two-stage macOS infostealer distributed as a compiled AppleScript impersonating Maccy, a legitimate clipboard manager, hosted on a fake domain. The first stage uses JavaScript for Automation with Objective-C APIs to download payloads while avoiding shell commands. The second stage is a Rust-based Mach-O binary that validates stolen credentials through PAM before harvesting, reads browser databases directly using bundled SQLite, captures clipboard contents repeatedly via pbpaste, and exfiltrates encrypted data using ChaCha20-Poly1305. It establishes persistence through both modern and legacy login item APIs, masquerades as Finder or System Settings, and tricks victims into granting Full Disk Access through counterfeit alerts. The stealer contacts Ethereum RPC endpoints and employs region-based exclusions targeting Apple silicon systems while avoiding Commonwealth of Independent States countries.

Pulse ID: 6a471de6cf9848f2ef9503c0
Pulse Link: https://otx.alienvault.com/pulse/6a471de6cf9848f2ef9503c0
Pulse Author: AlienVault
Created: 2026-07-03 02:26:46

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #ChaCha20 #Clipboard #CyberSecurity #Endpoint #InfoSec #InfoStealer #Java #JavaScript #Mac #MacOS #OTX #OpenThreatExchange #RAT #RPC #Rust #SQL #bot #AlienVault

PamStealer: a Rust-based macOS infostealer that validates credentials through PAM

PamStealer is a two-stage macOS infostealer distributed as a compiled AppleScript impersonating Maccy, a legitimate clipboard manager, hosted on a fake domain. The first stage uses JavaScript for Automation with Objective-C APIs to download payloads while avoiding shell commands. The second stage is a Rust-based Mach-O binary that validates stolen credentials through PAM before harvesting, reads browser databases directly using bundled SQLite, captures clipboard contents repeatedly via pbpaste, and exfiltrates encrypted data using ChaCha20-Poly1305. It establishes persistence through both modern and legacy login item APIs, masquerades as Finder or System Settings, and tricks victims into granting Full Disk Access through counterfeit alerts. The stealer contacts Ethereum RPC endpoints and employs region-based exclusions targeting Apple silicon systems while avoiding Commonwealth of Independent States countries.

Pulse ID: 6a471de6cf9848f2ef9503c0
Pulse Link: https://otx.alienvault.com/pulse/6a471de6cf9848f2ef9503c0
Pulse Author: AlienVault
Created: 2026-07-03 02:26:46

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #ChaCha20 #Clipboard #CyberSecurity #Endpoint #InfoSec #InfoStealer #Java #JavaScript #Mac #MacOS #OTX #OpenThreatExchange #RAT #RPC #Rust #SQL #bot #AlienVault

PamStealer: a Rust-based macOS infostealer that validates credentials through PAM

PamStealer is a two-stage macOS infostealer distributed as a compiled AppleScript impersonating Maccy, a legitimate clipboard manager, hosted on a fake domain. The first stage uses JavaScript for Automation with Objective-C APIs to download payloads while avoiding shell commands. The second stage is a Rust-based Mach-O binary that validates stolen credentials through PAM before harvesting, reads browser databases directly using bundled SQLite, captures clipboard contents repeatedly via pbpaste, and exfiltrates encrypted data using ChaCha20-Poly1305. It establishes persistence through both modern and legacy login item APIs, masquerades as Finder or System Settings, and tricks victims into granting Full Disk Access through counterfeit alerts. The stealer contacts Ethereum RPC endpoints and employs region-based exclusions targeting Apple silicon systems while avoiding Commonwealth of Independent States countries.

Pulse ID: 6a471de6cf9848f2ef9503c0
Pulse Link: https://otx.alienvault.com/pulse/6a471de6cf9848f2ef9503c0
Pulse Author: AlienVault
Created: 2026-07-03 02:26:46

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #ChaCha20 #Clipboard #CyberSecurity #Endpoint #InfoSec #InfoStealer #Java #JavaScript #Mac #MacOS #OTX #OpenThreatExchange #RAT #RPC #Rust #SQL #bot #AlienVault

Opera rilascia oggi Paste Protect, una nuova funzione per bloccare i comandi sospetti copiati dai siti web. Questo strumento migliora la sicurezza della #clipboard prevenendo l'esecuzione di script malevoli. #opera #cybersecurity https://kiro.it/Uod25

Opera rilascia oggi Paste Protect, una nuova funzione per bloccare i comandi sospetti copiati dai siti web. Questo strumento migliora la sicurezza della #clipboard prevenendo l'esecuzione di script malevoli. #opera #cybersecurity https://kiro.it/Uod25

Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula

In May 2026, an attack campaign targeting banking users in Spain and Portugal was identified involving the Ousaban banking Trojan. The malware, previously active in Brazil, spreads through phishing PDFs that redirect victims to malicious webpages performing environment checks to ensure targets are located in Spain or Portugal. The attack chain involves VBS scripts downloading steganographic images containing the payload, which is then dropped and executed on victims' systems. Ousaban establishes persistence, monitors banking activity across multiple financial institutions, and uses daily-changing DDNS domains to resolve C2 server addresses. The malware employs screenshot capture, keylogging, clipboard injection, and remote control capabilities to steal banking credentials. It utilizes custom encryption algorithms and geofencing techniques to evade detection and limit exposure to intended targets.

Pulse ID: 6a45880f3df872860c77a553
Pulse Link: https://otx.alienvault.com/pulse/6a45880f3df872860c77a553
Pulse Author: AlienVault
Created: 2026-07-01 21:35:11

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Bank #BankingTrojan #Brazil #Clipboard #CyberSecurity #DNS #Encryption #InfoSec #Malware #OTX #OpenThreatExchange #PDF #Phishing #Portugal #Spain #Trojan #VBS #bot #AlienVault

Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula

In May 2026, an attack campaign targeting banking users in Spain and Portugal was identified involving the Ousaban banking Trojan. The malware, previously active in Brazil, spreads through phishing PDFs that redirect victims to malicious webpages performing environment checks to ensure targets are located in Spain or Portugal. The attack chain involves VBS scripts downloading steganographic images containing the payload, which is then dropped and executed on victims' systems. Ousaban establishes persistence, monitors banking activity across multiple financial institutions, and uses daily-changing DDNS domains to resolve C2 server addresses. The malware employs screenshot capture, keylogging, clipboard injection, and remote control capabilities to steal banking credentials. It utilizes custom encryption algorithms and geofencing techniques to evade detection and limit exposure to intended targets.

Pulse ID: 6a45880f3df872860c77a553
Pulse Link: https://otx.alienvault.com/pulse/6a45880f3df872860c77a553
Pulse Author: AlienVault
Created: 2026-07-01 21:35:11

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Bank #BankingTrojan #Brazil #Clipboard #CyberSecurity #DNS #Encryption #InfoSec #Malware #OTX #OpenThreatExchange #PDF #Phishing #Portugal #Spain #Trojan #VBS #bot #AlienVault

Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers via Malicious Updates

Pulse ID: 6a449688c3850bff89921001
Pulse Link: https://otx.alienvault.com/pulse/6a449688c3850bff89921001
Pulse Author: Tr1sa111
Created: 2026-07-01 04:24:40

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Chrome #Clipboard #CyberSecurity #FireFox #InfoSec #OTX #OpenThreatExchange #VPN #bot #Tr1sa111

Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers via Malicious Updates

Pulse ID: 6a449688c3850bff89921001
Pulse Link: https://otx.alienvault.com/pulse/6a449688c3850bff89921001
Pulse Author: Tr1sa111
Created: 2026-07-01 04:24:40

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Chrome #Clipboard #CyberSecurity #FireFox #InfoSec #OTX #OpenThreatExchange #VPN #bot #Tr1sa111

Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers via Malicious Updates

Malicious browser extensions distributed through Chrome Web Store and Firefox Add-ons marketplaces posed as free VPN services while secretly stealing clipboard data. The Chrome extension, with 146 users, and Firefox extension, with 3,499 users, initially functioned as proxy tools but later incorporated clipboard theft through staged updates. Chrome versions 1.1 onwards and Firefox version 1.3.3 onwards continuously monitored clipboard contents every 500-1500 milliseconds, capturing passwords, API keys, cryptocurrency addresses, and authentication tokens. Stolen data was chunked, tagged with session identifiers, and exfiltrated via HTTP to attacker-controlled infrastructure at multiple IP addresses. Both extensions shared code patterns, infrastructure, and exfiltration endpoints despite appearing as separate products, indicating coordinated malicious operations behind legitimate-appearing privacy tools.

Pulse ID: 6a43b188e88186c48de04785
Pulse Link: https://otx.alienvault.com/pulse/6a43b188e88186c48de04785
Pulse Author: AlienVault
Created: 2026-06-30 12:07:36

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #Chrome #ChromeExtension #Clipboard #CyberSecurity #Endpoint #FireFox #HTTP #InfoSec #OTX #OpenThreatExchange #Password #Passwords #Privacy #Proxy #RAT #Troll #VPN #Word #bot #cryptocurrency #AlienVault

Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers via Malicious Updates

Malicious browser extensions distributed through Chrome Web Store and Firefox Add-ons marketplaces posed as free VPN services while secretly stealing clipboard data. The Chrome extension, with 146 users, and Firefox extension, with 3,499 users, initially functioned as proxy tools but later incorporated clipboard theft through staged updates. Chrome versions 1.1 onwards and Firefox version 1.3.3 onwards continuously monitored clipboard contents every 500-1500 milliseconds, capturing passwords, API keys, cryptocurrency addresses, and authentication tokens. Stolen data was chunked, tagged with session identifiers, and exfiltrated via HTTP to attacker-controlled infrastructure at multiple IP addresses. Both extensions shared code patterns, infrastructure, and exfiltration endpoints despite appearing as separate products, indicating coordinated malicious operations behind legitimate-appearing privacy tools.

Pulse ID: 6a43b188e88186c48de04785
Pulse Link: https://otx.alienvault.com/pulse/6a43b188e88186c48de04785
Pulse Author: AlienVault
Created: 2026-06-30 12:07:36

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #Chrome #ChromeExtension #Clipboard #CyberSecurity #Endpoint #FireFox #HTTP #InfoSec #OTX #OpenThreatExchange #Password #Passwords #Privacy #Proxy #RAT #Troll #VPN #Word #bot #cryptocurrency #AlienVault

PHISH ALERT: From a Simple Phishing Email to a Full Attack Arsenal: The Evolution of "ClickFix"

A sophisticated phishing campaign leverages evolved ClickFix techniques to bypass modern endpoint security through victim-assisted execution. Targets receive emails with urgent OneDrive document lures containing malicious ZIP attachments. The attack uses LNK shortcuts that redirect victims to landing pages, silently injecting PowerShell commands into their clipboard. Through social engineering, victims are tricked into manually executing commands via Win+R, circumventing traditional security filters. The campaign employs DNS TXT records for payload staging, avoiding HTTP detection. The threat infrastructure hosts multiple malicious components including obfuscated scripts, fake MSI installers masquerading as legitimate software like ConnectWise, and ISO images with spyware for persistent access. This represents a shift toward long-game tactics focused on establishing full post-compromise environmental control.

Pulse ID: 6a3a7809c43cfba36348ed9d
Pulse Link: https://otx.alienvault.com/pulse/6a3a7809c43cfba36348ed9d
Pulse Author: AlienVault
Created: 2026-06-23 12:11:53

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Clipboard #ConnectWise #CyberSecurity #DNS #EDR #Email #Endpoint #HTTP #ICS #InfoSec #LNK #OTX #OpenThreatExchange #Phishing #PowerShell #SocialEngineering #SpyWare #ZIP #bot #AlienVault

PHISH ALERT: From a Simple Phishing Email to a Full Attack Arsenal: The Evolution of "ClickFix"

A sophisticated phishing campaign leverages evolved ClickFix techniques to bypass modern endpoint security through victim-assisted execution. Targets receive emails with urgent OneDrive document lures containing malicious ZIP attachments. The attack uses LNK shortcuts that redirect victims to landing pages, silently injecting PowerShell commands into their clipboard. Through social engineering, victims are tricked into manually executing commands via Win+R, circumventing traditional security filters. The campaign employs DNS TXT records for payload staging, avoiding HTTP detection. The threat infrastructure hosts multiple malicious components including obfuscated scripts, fake MSI installers masquerading as legitimate software like ConnectWise, and ISO images with spyware for persistent access. This represents a shift toward long-game tactics focused on establishing full post-compromise environmental control.

Pulse ID: 6a3a7809c43cfba36348ed9d
Pulse Link: https://otx.alienvault.com/pulse/6a3a7809c43cfba36348ed9d
Pulse Author: AlienVault
Created: 2026-06-23 12:11:53

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Clipboard #ConnectWise #CyberSecurity #DNS #EDR #Email #Endpoint #HTTP #ICS #InfoSec #LNK #OTX #OpenThreatExchange #Phishing #PowerShell #SocialEngineering #SpyWare #ZIP #bot #AlienVault

Rust Clipboard Hijacker Abuses GitHub and VirusTotal

Pulse ID: 6a369bedfce92de92c80fa34
Pulse Link: https://otx.alienvault.com/pulse/6a369bedfce92de92c80fa34
Pulse Author: cryptocti
Created: 2026-06-20 13:55:57

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Clipboard #CyberSecurity #GitHub #InfoSec #OTX #OpenThreatExchange #Rust #VirusTotal #bot #cryptocti

Rust Clipboard Hijacker Abuses GitHub and VirusTotal

Pulse ID: 6a369bedfce92de92c80fa34
Pulse Link: https://otx.alienvault.com/pulse/6a369bedfce92de92c80fa34
Pulse Author: cryptocti
Created: 2026-06-20 13:55:57

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Clipboard #CyberSecurity #GitHub #InfoSec #OTX #OpenThreatExchange #Rust #VirusTotal #bot #cryptocti

Crypto Clipper uses Tor and worm-like propagation for persistence and control - https://www.redpacketsecurity.com/crypto-clipper-uses-tor-and-worm-like-propagation-for-persistence-and-control/

#threatintel
#crypto-clipper
#malware-analysis
#tor
#clipboard-theft
#wallet-attack

Crypto Clipper uses Tor and worm-like propagation for persistence and control - https://www.redpacketsecurity.com/crypto-clipper-uses-tor-and-worm-like-propagation-for-persistence-and-control/

#threatintel
#crypto-clipper
#malware-analysis
#tor
#clipboard-theft
#wallet-attack

Ship log for Yank, week of Jun 8:

• Silent auto-update on launch (Tauri v2 updater + signing key, losing that key is one-way, by the way)
• Subtle GitHub Issues link in the Tweaks panel
• v0.7.35 released

Deliberately taking a polish-week before the next big feature. A clipboard manager earns trust by being boring most of the time.

https://tryyank.com · MIT

#rust #tauri #foss #opensource #devtools #clipboard

Clipboard Plus #Editor #Component #Clipboardplus #Tool #Copypaste #Clipboardtool #Clipboard #Clipboard #Clipboard #Workflow #AssetStore

https://u3dn.com/packages/clipboard-plus-309659

Copying Remote Command Output to Your macOS Clipboard

A small trick to copy command output from a remote ssh session directly into the local macOS clipboard, using OSC 52 and a tiny shell script.

https://it-notes.dragas.net/2026/05/26/copying-remote-command-output-to-your-macos-clipboard/

#ITNotes #macOS #Mac #Apple #shell #ssh #Linux #FreeBSD #NetBSD #OpenBSD #illumos #Terminal #Clipboard

Copying Remote Command Output to Your macOS Clipboard

A small trick to copy command output from a remote ssh session directly into the local macOS clipboard, using OSC 52 and a tiny shell script.

https://it-notes.dragas.net/2026/05/26/copying-remote-command-output-to-your-macos-clipboard/

#ITNotes #macOS #Mac #Apple #shell #ssh #Linux #FreeBSD #NetBSD #OpenBSD #illumos #Terminal #Clipboard

macOS finally fixed a clipboard sync issue with the latest update that I always found incredibly stupid.

Two Apple devices on the same network could share the clipboard if both were on WiFi, but if one device was connected to the internet via Ethernet, it apparently ended up on a different subnet and clipboard sharing stopped working. Even though it was wired, you still had to enable WiFi.

The latest update fixed this. Small detail, but it was really annoying for me.

#macOS #clipboard #apple

macOS finally fixed a clipboard sync issue with the latest update that I always found incredibly stupid.

Two Apple devices on the same network could share the clipboard if both were on WiFi, but if one device was connected to the internet via Ethernet, it apparently ended up on a different subnet and clipboard sharing stopped working. Even though it was wired, you still had to enable WiFi.

The latest update fixed this. Small detail, but it was really annoying for me.

#macOS #clipboard #apple

After some time another #crafting experiment.
This time I decided to attempt making a #clipboard a project that is pretty easy and quick to do. The only problem I faced was the "rivets" (i don't know what is their real name), I didn't had the proper tool to secure them, so they are a little bit deformed. Follow me on #kofi (all posts are free): https://ko-fi.com/post/A-new-experiment-a-clipboard-homemade-R5R61XH3C6 #art #artandcraft
#bookbinding #craft #crafts #handmade #diy #cardboard #paper #hardcover #papercraft #handcraft

After some time another #crafting experiment.
This time I decided to attempt making a #clipboard a project that is pretty easy and quick to do. The only problem I faced was the "rivets" (i don't know what is their real name), I didn't had the proper tool to secure them, so they are a little bit deformed. Follow me on #kofi (all posts are free): https://ko-fi.com/post/A-new-experiment-a-clipboard-homemade-R5R61XH3C6 #art #artandcraft
#bookbinding #craft #crafts #handmade #diy #cardboard #paper #hardcover #papercraft #handcraft

clipboard-mcp: даём AI-ассистентам доступ к буферу обмена

AI-ассистенты в 2026 году умеют писать код, анализировать данные и управлять инфраструктурой. Но попросите Claude прочитать то, что вы только что скопировали — и он разведёт руками. Буфер обмена — одна из самых базовых вещей в десктопном workflow, и AI к нему доступа не имеет. Я написал clipboard-mcp , чтобы это исправить.

https://habr.com/ru/articles/1015844/

#rust #mcp #clipboard #ai #claude #open_source #model_context_protocol

ClipCascade is an open-source lightweight utility that automatically syncs the clipboard across devices

This is a nice private option to sync across all your devices in real-time, and you can self-host you own sync device, rely on peer-to-peer between devices, or use their cloud sync. Traffic is end-to-end encrypted. It can support multiple users keep ...continues

See https://gadgeteer.co.za/clipcascade-is-an-open-source-lightweight-utility-that-automatically-syncs-the-clipboard-across-devices/

#clipboard #opensource #privacy #technology

ClipCascade is an open-source lightweight utility that automatically syncs the clipboard across devices

This is a nice private option to sync across all your devices in real-time, and you can self-host you own sync device, rely on peer-to-peer between devices, or use their cloud sync. Traffic is end-to-end encrypted. It can support multiple users keep ...continues

See https://gadgeteer.co.za/clipcascade-is-an-open-source-lightweight-utility-that-automatically-syncs-the-clipboard-across-devices/

#clipboard #opensource #privacy #technology

ClipCascade is an open-source lightweight utility that automatically syncs the clipboard across devices

https://squeet.me/display/962c3e10-d36568fa-ed470aa1f42ca3cb

ClipCascade is an open-source lightweight utility that automatically syncs the clipboard across devices

https://squeet.me/display/962c3e10-d36568fa-ed470aa1f42ca3cb

[Перевод] 10 веб-API, заменяющих многие библиотеки JavaScript

Современные браузеры тихо съедают экосистему JavaScript живьем. За последние несколько лет основные браузеры выпустили нативные веб-API, которые заменяют удивительно большое количество утилит, которые мы до сих пор устанавливаем по привычке. Тем не менее, многие разработчики продолжают использовать уже ненужные, но привычные библиотеки. Если зависимость всегда работала, она остается в стеке, даже если браузер уже умеет выполнять ту же работу. Такой подход обходится дороже, чем кажется. Каждый дополнительный пакет увеличивает вес сборки, затраты на обслуживание, частоту обновления версий и риск отказа от проекта в долгосрочной перспективе. Нативные API-интерфейсы стоят пользователям 0 КБ данных, работают глубоко в движке (часто вне основного потока (main thread)) и используют оптимизации, недоступные библиотекам.

https://habr.com/ru/articles/1015134/

#javascript #js #webapi #fetch #formdata #url #popover #clipboard #resizeobserver #viewtransitions

Ah yes, the top-secret #encryption so bulletproof that a mere copy-paste #bug can bring it to its knees! 🤦‍♂️ Remember kids, when in doubt, blame it on the clipboard! 😂🔒
https://jtsylve.blog/post/2026/03/18/PSpice-Encryption-Weakness #clipboard #security #humor #technology #HackerNews #ngated

Ah yes, the top-secret #encryption so bulletproof that a mere copy-paste #bug can bring it to its knees! 🤦‍♂️ Remember kids, when in doubt, blame it on the clipboard! 😂🔒
https://jtsylve.blog/post/2026/03/18/PSpice-Encryption-Weakness #clipboard #security #humor #technology #HackerNews #ngated

Apple has had over a decade to fix this iOS email copy bug, and it still hasn’t

https://fed.brid.gy/r/https://nerds.xyz/2026/03/apple-mailto/

Apple has had over a decade to fix this iOS email copy bug, and it still hasn’t

https://web.brid.gy/r/https://nerds.xyz/2026/03/apple-mailto/