Ethereum clipboard hijacker malware substituted recipient address
- Scam type: Hack
- Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
- Incident date: 2026-05-30
- Reported: 2026-06-01
- Last updated: 2026-06-01
A macOS clipboard hijacker automatically replaced copied Ethereum addresses with this recipient address. Local forensic evidence identified malicious persistence via fake Apple-looking LaunchDaemons and hidden Application Support payloads: com.apple.accountsd.helper / AccountsHelper and com.apple.metadata.mds.worker / mdworker_shared. XProtect behavioral analytics flagged DataExfil.Clipboard and Network.Outgoing for the malicious payloads. Payloads were quarantined locally; this report is to flag the recipient address used by the clipper malware.