Fake Reviews, AI Narrators and VirusTotal Poisoning: How a Clipper Malware Campaign Fakes Trust Across the Web

A single threat actor is running a coordinated campaign to push a Rust-based cryptocurrency clipboard hijacker across Windows and macOS. The malware monitors the clipboard for wallet addresses and replaces them with attacker-controlled addresses, diverting funds to the attacker. What makes this campaign unusual is the heavy use of reputation manipulation on multiple platforms: fake reviews, AI-narrated tutorial videos, promoted news posts, and coordinated comments on VirusTotal to misclassify malicious files as safe. The goal is to create a convincing facade of legitimacy so that victims download and run the malware under the impression they are installing a useful tool such as a Solana sniper bot, a Pump.fun game predictor, or a similar utility.

For anyone who searches for software before installing, the campaign’s fake reputation economy is designed to appear everywhere a cautious user might look. The actor borrows the exact playbook legitimate brands use to build buzz—inflated download counts, coordinated five-star reviews, influencer-style videos, and promotion on trusted platforms—only to redirect those clicks into a theft operation. This is not a single-vector attack; it is a multi-platform deception designed to exploit the trust people place in social proof and platform signals.

How the Campaign Builds a Fake Reputation Across the Web

The threat actor begins by seeding promoted or paid posts on legitimate news and software review websites. These posts present the malware as a legitimate utility, often framed as a tool that can help users profit from trading bots, token launches, or prediction markets on Solana and Pump.fun. The actor also operates a dedicated WordPress phishing page that serves as the central hub for downloads and instructions. From there, traffic is funneled to GitHub and SourceForge repositories promoted by fake developer accounts, a YouTube channel with AI-narrated tutorials, and coordinated clusters of accounts that interact with VirusTotal to push the malicious files toward a “clean” classification.

The scale of the deception is visible in the numbers. One GitHub repository linked to the campaign has accumulated 146 stars and 62 forks, metrics that typically signal active community interest. On SourceForge, the download counter reached 44,485, with a suspicious 37,460 downloads supposedly originating from Android devices despite the tool only supporting Windows and macOS. Security researchers attribute the inflated count to the use of an Android device farm—networks of emulated devices that artificially inflate download statistics. The actor is effectively exploiting the psychology of social proof: users see high download counts and assume the software is popular and safe, even when the numbers are artificially pumped.

VirusTotal Poisoning: Gaming the “Safe File” Signal

One of the most technically sophisticated elements of the campaign is the use of VirusTotal poisoning. The actor maintains a network of accounts that upload the malicious files to VirusTotal and then submit highly positive comments and upvotes to misclassify the files as safe. VirusTotal aggregates results from dozens of antivirus engines, and a file with many “clean” verdicts can appear trustworthy in search results and third-party download sites. When potential victims scan the file themselves or see VirusTotal results embedded in reviews or forum posts, they are more likely to proceed with the download.

This tactic is particularly effective because many users rely on VirusTotal as a quick safety check. By manipulating the platform’s scoring system, the attacker creates a false sense of security that persists even after the malware has been widely distributed. The coordinated nature of the activity—multiple accounts submitting comments and ratings in a short time—makes detection harder and allows the malicious files to remain available for longer periods. Platforms like VirusTotal are aware of this abuse and continuously refine their detection of coordinated reputation manipulation, but the cat-and-mouse game continues as attackers adapt their methods.

GitHub and SourceForge: Fake Developer Profiles and Inflated Metrics

The campaign operates at least six GitHub accounts, each promoting repositories that ostensibly offer tools for Solana trading bots, Pump.fun predictors, or other crypto utilities. These accounts use stolen or AI-generated profile pictures, bios copied from real developers, and commit histories that mimic legitimate open-source projects. The repositories contain obfuscated Rust code that ultimately delivers the clipboard hijacker. The presence of stars, forks, and commit activity is designed to mimic genuine community engagement, making the projects appear credible at a glance.

On SourceForge, the same actor has pushed downloads to appear far more widespread than they actually are. The platform’s public download counters are vulnerable to manipulation via device farms or automated scripts, and the attacker exploited this by generating tens of thousands of fake downloads. The discrepancy between the supposed Android downloads and the actual supported platforms is a red flag that highlights how download statistics can be gamed. Users who rely on these numbers as a proxy for safety are being misled, and the campaign’s success depends on this deception.

YouTube and AI Narrators: Turning Video Tutorials Into Distribution Channels

The actor runs a YouTube channel that publishes tutorial-style videos demonstrating how to use the supposed Solana sniper bot or Pump.fun predictor. The videos are narrated using AI-generated voices, a tactic that lowers production costs and makes it easier to scale the campaign across multiple languages. The tutorials walk viewers through downloading and installing the software, embedding the malicious payload in what appears to be a legitimate setup process. The videos often rank well in search results due to the use of SEO-friendly titles and descriptions that mimic legitimate crypto content.

YouTube’s recommendation algorithms can inadvertently amplify this content by suggesting it to users searching for trading tools or profit-making strategies. Because the videos look and sound professional—thanks to AI narration and screen recordings of seemingly functional software—they provide a convincing facade of legitimacy. The combination of video tutorials, AI voices, and fake reviews creates a multi-sensory deception that is difficult for casual users to see through.

The Rust-Based Clipper: Silent Theft on Windows and macOS

The final payload is a Rust-based clipboard hijacker that runs on both Windows and macOS. Once installed, it continuously monitors the clipboard for strings that match common cryptocurrency wallet address patterns. When a match is detected, the malware substitutes the victim’s wallet address with one from a hard-coded list controlled by the attacker. The swap happens in real time, often without the user noticing, and the transaction proceeds to the attacker’s address instead of the intended recipient.

This type of attack is particularly effective in fast-moving environments like cryptocurrency trading, token launches, or prediction markets, where users frequently copy and paste wallet addresses. The malware does not require elevated privileges to operate, making it stealthy and hard to detect once running in the background. Because the theft occurs at the clipboard level, traditional antivirus tools may not flag the behavior until after the funds are gone. The Rust implementation adds another layer of obfuscation, as Rust binaries can be more difficult to reverse-engineer than those written in languages like C or Python.

Who Is the Target—and Why This Campaign Is Effective

The primary targets are cryptocurrency asset holders and online gamblers who are actively searching for tools promising quick profits. These users are already incentivized to take risks, making them more susceptible to social proof and the promise of high returns. The campaign’s fake reputation economy is tailored to this audience: it uses the language of crypto trading, references popular platforms like Solana and Pump.fun, and leverages the visual aesthetics of legitimate trading tools.

The campaign’s effectiveness lies in its ability to exploit the trust people place in platforms and metrics they assume are objective. When a tool has thousands of downloads, high ratings, and clean VirusTotal scans, users feel safer downloading and running it. The attacker’s use of AI narrators, fake reviews, and coordinated reputation manipulation creates a self-reinforcing loop of trust that is hard to break without deeper scrutiny. For many users, the time and expertise required to verify the legitimacy of a tool are prohibitive, leaving them vulnerable to this kind of deception.

What Users and Platforms Can Do to Protect Themselves

Users should treat any software claiming to offer shortcuts to crypto profits with extreme skepticism. If a tool promises unusually high returns or automated trading advantages, it is likely a scam or contains malware. Before downloading, users should verify the software’s legitimacy through multiple independent sources: check the developer’s history on GitHub, look for third-party reviews from reputable tech publications, and avoid relying solely on download counts or star ratings. Cross-referencing information across platforms can help identify inconsistencies that reveal a fake reputation campaign.

Platforms must also take steps to combat abuse of their reputation systems. SourceForge and GitHub should implement stricter validation for download counters and star metrics, especially for projects in high-risk categories like crypto tools. VirusTotal can improve detection of coordinated reputation manipulation by flagging accounts that submit suspiciously uniform comments or ratings in a short time. YouTube should tighten its policies around crypto-related tutorials, particularly those promoting tools that facilitate financial transactions, and invest in better detection of AI-generated voices used to narrate deceptive content. Transparency reports and public disclosures about enforcement actions can help users and researchers understand the scope of the problem.

What to Watch Next—and How the Campaign Might Evolve

This campaign is likely just one example of a broader trend in which threat actors weaponize the trust mechanisms of the internet to distribute malware. As platforms improve their detection of fake reviews and coordinated activity, attackers will likely shift to more sophisticated tactics, such as using smaller, harder-to-detect networks of accounts or leveraging deepfake videos to narrate tutorials. The use of Rust as the malware’s programming language may also become more common, as Rust’s compiled binaries are harder to analyze and reverse-engineer.

Security researchers and platform operators should monitor for similar campaigns targeting other high-value sectors, such as decentralized finance, NFT trading, or AI-powered tools. The combination of fake reputation, AI-generated content, and platform manipulation creates a potent threat model that could be adapted to other types of malware, including ransomware or spyware. Early detection will require collaboration between security teams, platform providers, and independent researchers to share indicators of compromise and disrupt coordinated campaigns before they gain traction.

For now, the best defense remains skepticism and verification. If a tool looks too good to be true, it probably is. Users should prioritize security over convenience, especially when dealing with financial assets. Platforms must balance openness with safeguards to prevent their systems from being hijacked as vectors for trust. The internet’s reputation economy is powerful, but it is only as reliable as the mechanisms that underpin it—and right now, those mechanisms are under attack.