An emerging clipper malware dubbed “Laplas” has been targeting cryptocurrency users via the “SmokeLoader” malware. Cyble researchers observed this activity and detailed that SmokeLoader, which is delivered through malicious documents in spear-phishing campaigns, also acts as a carrier for various other malware including SystemBC and Raccoon Stealer 2.0. The Laplas malware is known for hijacking a cryptocurrency transaction by swapping the victim’s wallet address with the operator’s. This is conducted by monitoring the victim device’s clipboard and verifying if any copied data contains a cryptocurrency wallet address. Laplas generates a wallet address that is similar to the victim’s so that there is a smaller chance of the victim recognizing the attack. Laslas is advertised in cyber forums with feature details as well as prices for use. The clipper malware can support various cryptocurrency wallets, such as Bitcoin, Ethereum, Litecoin, Dogecoin, Monero, and more, and has various pricing options. 180 samples of Laplas have been identified by researchers within the last two (2) weeks and the rise in infections is expected to grow. Technical details as well as indicators of compromise (IOCs) can be viewed in Cyble’s report liked below. CTIX analysts will continue to monitor Laplas clipper activity and report on new incidents involving the malware as they appear.