Clipboard virus: what it is, how to check for it and remove it
Clipboard virus is malware that replaces a cryptocurrency wallet address on your clipboard with the thief's address, so a payment you confirm goes to the wrong owner. Test your PC with the Notepad check, remove it with Safe Mode and Microsoft Defender Offline, and read the chapter on lost funds if money has already moved.
Facts checked October 13, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Programs like a program that changes the cryptocurrency wallet address you paste usually arrive in groups; a free scan lists the companions that are easy to miss.
Do it yourself · free Remove Clipboard virus yourself 5 steps, about 15 minutes, no software needed.
Start the steps
Clipboard virus: summary
| Type | Cryptocurrency clipper (clipboard hijacker): a trojan that swaps a copied wallet address for the thief's; a behaviour shared by many families, not one program |
|---|---|
| Risk | High if you handle cryptocurrency: the stolen transfer cannot be reversed. Other damage depends on what came in the same bundle |
| Symptoms | Usually none. The only direct sign is a pasted address that differs from the one you copied |
| How to get rid of it | Stop crypto use on the device, Notepad test, full scan in Safe Mode, Microsoft Defender Offline, uninstall unknown programs, reset Windows if money is at stake |
| Our check (6 October 2026) | No PC test and no sample: we read Kaspersky's and ESET's reports and examined the three pictures of our 2019 guide |
| First seen | Our first guide 16 September 2019; the technique goes back to bank-number swappers in 2013 and CryptoShuffler in 2017 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 8 more facts
| Detection | Varies. Kaspersky: Trojan-Banker.Win32.CryptoShuffler.gen and Generic.ClipBanker; ESET: Android/Clipper.C; our 2019 picture: Trojan.GenericKD.41734615, TR/Rozena.zomsx, PowerShell/Rozena.EA. Microsoft: no name specific to clipping; its 2022 cryware report lists stealer detections such as Trojan:Win32/Azorult.RMA!MTB, Trojan:Win32/Raccoon.AD!MTB and Trojan:Win32/ArkeiStealer.DB!MTB |
|---|---|
| Platforms | Windows (since 2017), Android (since 2018), chat apps for Android and Windows (2023) |
| Not to be confused with | Ransomware, which locks files and shows a note; a clipper shows nothing |
| Name | Clipboard virus |
| Evidence | 4 write-ups by security sites; details still limited |
| Distribution | Typically fake installers, cracked programs, e-mail attachments, fake "verify you are human" pages and ads for popular apps |
| Damage | Installs other malware, often several programs at once |
| Facts checked | 6 October 2026 |
Checked on 6 October 2026 against Kaspersky's 2017 and 2023 reports, ESET's 2019 and 2023 reports, Microsoft's 2022 cryware report, the three pictures of our 2019 guide and four more Microsoft pages. No sample was run and no PC tested; the removal steps follow Microsoft's pages and were not tried on a live infection.
What a clipboard hijacker is, and what it does
"Clipboard virus" is a name for a kind of malware, not for one program. It waits for you to copy a cryptocurrency wallet address and, in the moment you paste it, puts the thief's address in its place. The money goes where the thief wants, and you only see the right-looking address that you copied.
- 1
It gets onto the device
The trojan arrives inside something you chose to run: an installer from a download site or a torrent, a cracked program, or a fake copy of an app. Kaspersky describes copies of Tor Browser that were repackaged in this way, and ESET describes fake Telegram and WhatsApp apps. Our 2019 guide also named infected email attachments, see the chapter on how it arrives.
- 2
It listens to the clipboard
The clipboard is the short-term memory that Ctrl+C fills and Ctrl+V reads. Kaspersky found that one family registers itself in the chain of Windows clipboard viewers and is told every time the clipboard changes. It needs no internet connection and uses almost no power while it waits.
- 3
It recognises a wallet address
Addresses are long and follow fixed patterns, so a short rule can spot them: Bitcoin addresses starting with bc1, Ethereum and other ERC-20 addresses that begin with 0x followed by 40 characters, Litecoin, Dogecoin and Monero patterns. The same rule set is built into the sample that Kaspersky took apart in 2023.
- 4
It swaps the address
When the text on the clipboard matches, the malware replaces it with one of its own addresses. In the 2023 sample the new address was picked at random from a hard-coded list that held thousands of Bitcoin addresses, which makes blocking them one by one and tracing the theft harder.
- 5
You paste and send
You paste, see a long string that looks like the one you copied, and confirm. The transfer then goes through exactly as you ordered it, to the wrong owner. Blockchain transfers cannot be undone, which is what makes this attack so costly.
- What it is
- A cryptocurrency clipper, also called a clipboard hijacker or clipboard injector; Kaspersky's generic name for many of them is Generic.ClipBanker
- Coins targeted
- Bitcoin, Ethereum and other ERC-20 tokens, Litecoin, Dogecoin and Monero (Kaspersky 2023); also Zcash and Dash (CryptoShuffler, 2017)
- Platforms
- Windows first (2017), Android since 2018, and chat apps for Android and Windows (ESET, 2023)
- Microsoft's term
- "Clipping and switching" by cryware; the older trojan type is ClipBanker (Microsoft Security Blog, May 2022)
- What you see
- Nothing, until the money has gone. It makes no pop-up and no ransom note
- Can it be undone?
- No. A confirmed blockchain transfer is final; see the chapter on lost funds
The old guide said the virus "performs malicious transactions" itself. That is not how it works: the malware only changes an address, and the transaction is one you sign yourself.
Clipboard hijacking malware: the names and the families behind it
Clipboard hijacking malware is a program that watches what you copy and silently swaps a cryptocurrency wallet address for one the thief controls.
You paste, check nothing, confirm, and the money goes to the attacker. Security vendors call the behaviour a clipper, a clipboard injector or a clipboard hijacker; these are three names for the same trick.
It is a behaviour shared by many families, not one program. Kaspersky tracked CryptoShuffler in 2017 and reported that it had quietly collected about 140,000 dollars in Bitcoin. In March 2023 Kaspersky described a wave of clipboard injectors aimed at crypto users. Detection names differ by vendor, such as Trojan-Banker.Win32.CryptoShuffler.gen.
The same idea runs on phones and in chat apps. ESET found the first clipper on Google Play in February 2019, detected as Android/Clipper.C. In March 2023 ESET reported trojanized WhatsApp and Telegram apps that replaced wallet addresses inside messages. So a clean Windows PC does not prove that a phone is clean.
Because the program shows nothing on screen, the only direct sign is a pasted address that differs from the one you copied. Compare the first and last characters of the address before every transfer, and test with a small amount first. If you find a mismatch, stop using crypto on that device and follow the removal chapters above.
What Clipboard virus does on an infected PC
What we looked at on 6 October 2026, and what we could not
A clipboard hijacker has no website to open and no single file to run, so our site test does not apply. What we did was read the research of Kaspersky and ESET, look at the three pictures of our 2019 guide, and write down what each of them does and does not show. We did not run a sample and we did not scan a PC.
What the sources and our old pictures show, 6 October 2026
- The attack is real and still currentKaspersky wrote in 2023 that the technique is "still very relevant" because the operating system offers no complete defence, and ESET found clippers inside chat apps the same year.
- It is a behaviour, not one familyCryptoShuffler (2017), Android/Clipper.C (2019), the Tor Browser clipper (2022 and 2023) and the chat-app clippers (2023) share one trick and have different code, so there is no single file to look for.
- The malware behind our 2019 guideThe old guide did not name the file or the family. Its pictures show one scanner list, so we know that about 20 products flagged one file, but not what the file was.
- Whether your PC has oneUnknown. The 2019 text says it shows no symptoms, and Kaspersky says a clipboard injector can stay silent for years with no network activity.
- A quiet PC or a clean scanProves nothing. The payload runs only when an address is on the clipboard, so sandboxes and scanners often never see it work. The test in the check chapter is one try with one address format.
High for anyone who sends cryptocurrency from a PC We cannot say whether your device has a hijacker. We can say that if it does, nothing slows it, nothing shows it and the loss is permanent. Treat every pasted address as unverified until you have compared it, and read the check chapter.
The scanner list in our 2019 pictures, read name by name
All three pictures of our 2019 guide show one scanner list for one file, with the product names on the left and the verdicts on the right. The names below are copied from the pictures; the right-hand column is our reading.
| Product | Name it showed | What the name tells us |
|---|---|---|
| Ad-Aware, BitDefender, eScan | Trojan.GenericKD.41734615 | A generic trojan rule with a signature number, so no family is named |
| Emsisoft | Trojan.GenericKD.41734615 (B) | The same signature, which fits products that share an engine; this is our reading |
| Avira | TR/Rozena.zomsx | Names the Rozena family. Microsoft's page for Rozena says this kind of threat can let an attacker download other malware, so it is not a clipper name on its own |
| F-Secure | Trojan.TR/Rozena.zomsx | The same Avira label under the F-Secure name |
| ESET-NOD32 | PowerShell/Rozena.EA | Rozena again, and a PowerShell loader this time |
| Dr.Web | Trojan.PWS.Stealer.26685 | PWS is the common tag for a password stealer. It points to more than a clipboard swap; we cannot say how much more |
| Cyren, F-Prot | W32/Kryptik.ADT.gen!Eldorado | Kryptik is a generic name for packed or obfuscated code |
| G Data | Win32.Packed.Kryptik.NQWE5F | The same idea: the file was packed |
| ALYac | Trojan.Agent.Wacatac | A generic Agent label; Wacatac is also the name Microsoft uses for many unrelated detections |
| Cybereason | Malicious.740718 | A generic verdict with a number |
| Fortinet | W32/Agent.XABGOJ!tr | A generic agent trojan |
| FireEye | Generic.mg.ac33a7288e39c656 | A generic rule that carries a file fingerprint |
| CrowdStrike Falcon, Cylance, Endgame, SecureAge APEX | Win/malicious_confidence_60% (W), Unsafe, Malicious (high Confidence), Malicious | Machine-learning verdicts with no family |
| Arcabit | Trojan.Generic.D27CD1D7 | The Arcabit form of the generic name |
So the list shows a packed trojan that was caught by many products, and that at least some of them treat as a loader or a stealer. Our 2019 guide quoted four of these names, among them Trojan.MalPack.GS, which none of the pictures shows. Your product will use other names, and a clipboard hijacker found in 2026 will have other names again.
How clipboard hijackers developed, from 2013 to 2023
The trick is older than cryptocurrency. Our guide dates from 16 September 2019; its first picture is placed where it belongs in this timeline.
2013
Bank account numbers
Kaspersky points to a CERT Polska warning of 2013 about Visual Basic malware that changed a bank account number when the user copied it. It only worked against particular banks and needed other fields to match, which limited the profit.
Late 2016 to October 2017
CryptoShuffler
Kaspersky found a trojan that watched the clipboard for wallet addresses of Bitcoin, Ethereum, Zcash, Monero, Dash, Dogecoin and others. The Bitcoin wallets of its authors held slightly more than 23 BTC, about $140,000 at the time of the report in October 2017. Peak activity came in late 2016, then a slump, then a new wave in June 2017. Kaspersky detects it as Trojan-Banker.Win32.CryptoShuffler.gen. Our 2019 guide wrote the name as CryptoSuffler.
March 2018
On a big download site
ESET reported a clipper that had been hosted on download.cnet.com, one of the largest software download sites in the world, which shows that a well-known site is no guarantee.
August 2018
The first Android clipper
ESET, citing a Dr.Web report, writes that the first Android clipper was sold on underground hacking forums in August 2018 and was then found in several unofficial app stores.
1 February 2019
Google Play
ESET found Android/Clipper.C on the official Play store just after it appeared, posing as a mobile version of MetaMask, a service that had no mobile app at the time. Besides swapping Bitcoin and Ethereum addresses it tried to steal credentials and private keys. Google removed it after ESET's report.
16 September 2019
Our first guide
The old text called Clipboard virus an extremely dangerous trojan that targets Bitcoin and Ethereum wallets, spreads through spam attachments, cracked software and fake updates, and shows no symptoms. Its first picture is a scanner list for one sample, headed with the guide's name.
From our 2019 guide: a scanner list for one file, with the green title Clipboard virus laid over part of it. It shows detections, not a clipboard being changed. 17 May 2022
Microsoft names the technique
Microsoft Threat Intelligence described "cryware", stealers aimed at hot wallets, and named "clipping and switching": malware that watches the clipboard for a string that looks like a wallet address and, when you press Ctrl+V, puts the attacker's address in its place. It also noted that ClipBanker trojans, which first watched for banking data, now watch for cryptocurrency addresses, and that the technique was becoming more common. The long, complex address makes it likely that people overlook a mismatch.
December 2021 to February 2023
Tor Browser installers
Kaspersky saw hundreds of trojanized Tor Browser installers, first in December 2021 and in a larger wave from August 2022. They came as unsigned self-extracting archives that started the real, signed installer as a disguise while unpacking a clipper into an AppData folder, where it set itself to start with Windows and often used the icon of a popular program such as uTorrent. About 16,000 detections turned up in at least 52 countries, mostly in Russia and Eastern Europe, and Kaspersky thinks the real number is several times higher. Roughly where they came from is unknown; Kaspersky found no website hosting them and guesses torrents or other downloaders.
16 March 2023
Inside chat apps
ESET described the first clippers built into messaging apps: trojanized Telegram and WhatsApp for Android and Windows. Some also used text recognition on screenshots to read recovery phrases. Victims were led there by Google Ads to fake YouTube channels and from there to copycat websites.
What Clipboard virus can steal or download
What a clipboard hijacker can cost you
The first risk is the one the name says. The others are what malware on the same device can do, as our 2019 guide warned.
- High
A payment that cannot be reversed
Kaspersky points out that the swap creates irreversible money transfers. Whole balances have been taken in one transfer, and our old guide said the attackers took significant sums from Bitcoin and Ethereum owners.
- High
Stolen passwords and wallet access
The 2019 guide said the malware can be set to steal stored data and saved website passwords. Some clippers do: Android/Clipper.C went after credentials and private keys, and ESET's chat-app clippers read recovery phrases from screenshots. A scanner list in our own pictures includes a password-stealer label from Dr.Web.
- High
More malware
The old guide said a clipboard virus can install other threats, change settings and even damage the computer. A trojan that is a loader, as the Rozena names in our pictures suggest, can fetch more software. Anything it adds is a separate infection.
- Medium
Identity and privacy
The old text warned that a long stay on the system puts data, privacy and identity at risk. It is a risk of any stealer; we found no case of this for a pure clipper.
- Medium
Slowdown from mining
The 2019 guide said the virus can also run a cryptocurrency miner, which would make the PC slow and busy. A clipper by itself does not, according to Kaspersky, who describes it as showing no network activity and no extra load. If your PC is slow, a miner or another program in the same bundle is the more likely cause.
Signs to look for, and what they really tell you
Our 2019 guide said that the infection is not noticeable at first and that the virus works in the background without visible symptoms. That is the main point of this malware, so the usual list of symptoms is short.
| Sign | What we found |
|---|---|
| A pasted address that is not the one you copied | The only direct sign. Comparing the first, middle and last characters after pasting catches it, and a mismatch means stop |
| A payment that arrived at an unknown address | The way most victims learn of it, when the recipient says the money never came. The money has already gone |
| Slow PC, fan noise, high processor use | Not caused by the clipboard swap. It can come from a miner or another program that came with it, or from many normal tasks |
| Unknown programs in Startup apps or an AppData folder | Kaspersky's Tor Browser sample copied itself into an AppData subfolder and registered for autostart. Look for names you cannot place |
| Browser or app you did not install from its maker | A copy of Tor Browser, Telegram or WhatsApp from a third-party site is the origin in Kaspersky's and ESET's cases |
| No sign at all | Does not mean it is clean. Kaspersky says a clipboard injector can stay silent for years |
How to check the PC for Clipboard virus
How a clipboard virus reaches a device
Our 2019 guide said that installations and infections can happen when you browse malicious sites or skip checking where a program comes from, and that spam attachments are the common route. Our sources add more cases, shown below.
- 1
Software from a third-party site or torrent
The Tor Browser clipper of 2022 and 2023 was found only in installers that people had not taken from torproject.org. Kaspersky wrote that the mistake of probably every victim was to download and run it from a third party, and that the official installers were signed and clean.
- 2
A fake or trojanized app
ESET found copies of Telegram and WhatsApp for Android and Windows with a clipper inside, and Android/Clipper.C pretending to be MetaMask on Google Play. The only official WhatsApp for Windows, according to ESET, was the one in the Microsoft Store.
- 3
An ad that leads to a copycat site
In the 2023 campaign Google Ads pointed to fake YouTube channels, which sent viewers to lookalike Telegram and WhatsApp sites. A sponsored result at the top of a search is not a safe place to start a download.
- 4
Spam attachments
The 2019 guide said the malware comes as DLL or EXE files attached to emails about financial details, orders or shipping. We found no research from the last years that tells the same, so we keep it as the old guide's claim. Emails with invoice or parcel attachments are still a common way to spread malware in general.
- 5
Cracked programs and fake updates
The old text listed cracked software and fake updates. This is how many trojans travel, and a clipper is easy to add to a bundle; we found no case of a specific clipper that came with a crack.
- 6
A real program that a scanner calls dangerous
The pattern of the clipper, a program that reads the clipboard and writes to it, is shared by clipboard managers and password managers, which are legitimate. If your product flags one of them, check the file as described below before you remove it.
In every case the victim started the file. A device that has not run anything new is hard to infect this way.
Check your PC and your habits
The test in the first step is the one Kaspersky published in 2023. It takes a minute and touches nothing important. It can show an infection; it can never show that there is none.
- 1
Run the Notepad test
Open Notepad. Type bc1 followed by 35 or more letters and digits that make no sense, for example the word
malwaretyped five times after bc1; Kaspersky used a made-up string of the same kind, which is not a real address. Select it, press Ctrl + C, then Ctrl + V in a new line. If the text changes into something else, a clipboard injector is running and you should stop using that device for money. Kaspersky tested its own string of this kind on the sample and it worked; if the authors learn to ignore such texts, other test strings will be needed. - 2
Test other address formats too
Try the same with
0xfollowed by 40 letters and digits from 0 to 9 and a to f. A clipper is built around one rule per coin, so a malware that watches only Ethereum will ignore a Bitcoin-style test. - 3
Read the address after you paste
Compare the start, the middle and the end of the pasted address with the one you copied, not just the first characters, and do it in the wallet's own confirmation screen. ESET's advice for Android is the same: always check that what you pasted is what you meant to enter.
- 4
Send a small amount first
For a large transfer to a new address, send a small amount first and confirm with the recipient that it arrived. This is our suggestion, not a statement of either vendor.
- 5
Keep secrets out of the clipboard and screenshots
Do not copy a recovery phrase or a private key to the clipboard, and do not keep screenshots of them, because ESET found clippers that read text out of pictures. To empty the Windows clipboard history, open Start > Settings > System > Clipboard and press Clear under Clear clipboard data. Microsoft says Windows logo key + V shows the history.
- 6
Look at what starts with Windows
Open Task Manager with Ctrl + Shift + Esc, go to Startup apps and write down entries you cannot place. Then open Settings > Apps > Installed apps and sort by install date for programs that came with a recent download.
How to remove Clipboard virus
A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.
Step 1: Delete scheduled tasks that bring it back
Open Task Scheduler from the Start menu and click Task Scheduler Library. Select each task you do not recognise and read the Actions tab:
- a task that starts a file in
%AppData%or%Temp% - runs
powershellwith a long encoded line - opens a web address belongs to Clipboard virus or a similar program
Right-click such a task and choose Delete, and check the subfolders too. Leave tasks from Microsoft, your PC's maker and programs you use. Task Scheduler is the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
- a task that starts a file in
Step 2: Remove it from startup
Whatever Clipboard virus installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc, go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.
Open file location on the right-click menu shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items), and go through
%LocalAppData%,%AppData%, %ProgramData% and the two Program Files folders.Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold
.exe,.dll, .js or .ps1 files are the strongest sign.Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Assume that the passwords saved in this PC's browsers, and the accounts that were open in them, are known to the attacker. From a phone or a clean computer, change the e-mail password first, then banking, shopping, social and gaming accounts.
Use each service's option to sign out of all other sessions, because stolen cookies keep a session open even after a password change. Turn on two-step verification on each account. Wait with the infected Windows 11 or Windows 10 PC until the scans are clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Remove it from Windows 11 and Windows 10
Our 2019 guide told readers to enter Safe Mode with Networking and run an anti-malware scan. It also gave System Restore as a second method. We have kept both, with current menus, and we have not tried these steps on a live infection; they follow Microsoft's documentation. Kaspersky advises that a device that carried a clipper should not be trusted until it is rebuilt.
- 1
Stop sending money from this device
Do not send or receive cryptocurrency on it, and do not log in to exchanges until the device is clean. Use another device, and keep the money where it is for now.
- 2
Disconnect and back up documents
Switch off Wi-Fi or pull the network cable. Copy your documents and photos (not programs) to an external drive, then disconnect the drive.
- 3
Start in Safe Mode with Networking
Go to Settings > System > Recovery, press Restart now next to Advanced startup, then pick Troubleshoot > Advanced options > Startup Settings > Restart. When the list appears press 5 for Safe Mode with Networking. Microsoft says Safe Mode starts Windows with a minimal set of files and drivers, which also helps against malware that tries to block security software.
- 4
Run a full scan
Open Windows Security > Virus & threat protection > Scan options, tick Full scan and press Scan now. Windows 11 and 10 already contain Microsoft Defender, so no extra tool is needed. A full scan finds more than a quick one but, as the test chapter says, cannot prove that nothing is left.
- 5
Run Microsoft Defender Offline
Back in Scan options pick Microsoft Defender Offline scan and Scan now. Microsoft describes it as running in a trusted environment outside the normal Windows kernel, which helps against malware that evades the Windows shell. The PC restarts when the scan ends; read the outcome under Protection history.
- 6
Uninstall what you cannot account for
In Settings > Apps > Installed apps remove programs that you did not knowingly install, and every copy of Tor Browser, Telegram or WhatsApp that did not come from its maker or the Microsoft Store. Download them again only from the official site. Do not search the registry and AppData folders by hand; parts are easily missed and the wrong entry can break Windows.
- 7
Rebuild when money is at stake
If you keep or move cryptocurrency from this PC, the cleanest way is to reset it: after copying your documents elsewhere, use Settings > System > Recovery > Reset this PC > Remove everything, or install Windows from a USB stick. Bring back documents only, never programs or a system image.
- 8
Use System Restore only for a recent change
The 2019 guide offered System Restore as a method. Hold Windows logo + R, enter
rstrui.exeand select a restore point from before the problem. Microsoft describes System Restore as rolling back system files, registry settings and installed programs, and leaving personal files alone. Its page does not call it a malware cleaner, and a restore point made after the infection restores the infection.
Do not install a cleaner or a phone call's recommended "removal tool" because an advert said so. A genuine scan needs no payment page, and a cleaner that promises to remove malware and recover coins at the same time is the next scam.
Phones and other systems
The 2019 guide spoke only about Windows. Clippers have also been found on Android, so a phone owner needs a separate row. We found no Mac or iPhone case in the research we read, and we do not give steps for them.
| Device | What we found | What to do |
|---|---|---|
| Windows 11 and 10 | The case of the 2019 guide, CryptoShuffler and the Tor Browser clipper | The plan in the removal chapter |
| Android | Android/Clipper.C on Google Play in 2019; Telegram and WhatsApp copies in 2023 (ESET) | Open the phone's Settings > Apps, pick any app that does not come from its maker and use Uninstall; menu names differ by phone. Then run a scan in Play Protect from the profile menu of Google Play. We have not tried these steps on an infected phone |
| iPhone and iPad | No clipper in the sources we read | None given; keep apps to the App Store and check each address you paste |
| Mac | No clipper in the sources we read; the old guide named Windows only | None given |
If money was already sent to the wrong address
The old guide was honest about this: it cannot promise that you will get the money back, and that is the job of you and your wallet provider. Kaspersky agrees that the transfers are irreversible. What follows is how to give a chance a fair start.
- High
Write down the transaction first
Save the transaction ID, date and time, the amount, the address you meant and the address the money went to. Do not post the addresses publicly. A screenshot of the confirmation screen is also useful.
- High
Tell the provider quickly
If the money left an exchange or a wallet service, contact its support at once. The old guide said they can track funds if you react in time. If the thief's address belongs to an exchange, that exchange is the one that can freeze the account, and only if it is told early and the police ask.
- Medium
Report it to the police
File a report with your national cybercrime police. A report number is often needed by an exchange, and you will want it for a tax or insurance claim.
- High
Do not pay "recovery services"
Offers to get your coins back for a fee, often found by searching or sent by messages after a loss, are a second fraud. A transfer on the blockchain cannot be cancelled by a third party.
After removal: passwords, accounts and prevention
Accounts come next
Because the PC showed A program that changes the cryptocurrency wallet address you paste in the list of installed apps, a sign of a program that could read browser data, the clean-up is only half of the work. The other half happens in your online accounts.
Change passwords from a clean device, beginning with e-mail; sign out of all sessions; check forwarding rules and recovery phone numbers; and turn on two-step verification with an authenticator app or a passkey. Ask your bank to replace cards saved in the browser.
Why the order matters and what to check in each account: secure your accounts after malware.
Protect what is left
Cleaning the device does not undo what the malware could have seen. The steps assume the worst: that it also read your passwords and wallet keys.
- 1
Move the remaining coins with a clean device
Create a new wallet on a clean device, with a new recovery phrase that has never touched the old PC, and move the balance there. Do the transfer on the clean device and check the pasted address.
- 2
Change passwords from another device
Begin with your email, then exchanges and banking, then the rest, and switch on two-step sign-in. Do this from a clean device, not the suspect PC.
- 3
Sign out everywhere
Choose the option to sign out of all sessions in your exchange, Google, Microsoft and social accounts, which makes stolen session cookies useless.
- 4
Check your browsers
Open the extension list of every browser, remove what you did not add, and check the search engine and home page. Wallet extensions should come only from the wallet maker's own page.
- 5
Scan again in a week
Code that hides can survive a scan today. Run a full scan, and Defender Offline, again in a week.
Keep clipboard hijackers off your devices
The 2019 advice, to clean the mailbox, update from official sources and run a scan from time to time, still stands. These are its current forms.
Do
- Get programs from their makers or the Microsoft Store and Google Play, and check the maker's site for the link to the official app, as ESET advises.
- Download Tor Browser, Telegram and WhatsApp only from their official sites, because the clippers of 2022 and 2023 came in copies of them.
- Compare the start, middle and end of every pasted wallet address in the wallet's confirmation screen.
- Delete unexpected emails and attachments without opening them, and do not enable content in documents you did not expect.
- Keep Windows, browsers and apps up to date from official update channels.
- Keep Real-time protection of Microsoft Defender on, or one other reputable product, and scan fully from time to time.
- Back up documents to a drive you disconnect afterwards, with File History or OneDrive, so an infection costs a reinstall and not your files.
Don't
- Never run cracks, keygens or installers from torrent and file-sharing sites.
- Do not follow a sponsored search result or a video link to download a wallet or messenger.
- Do not paste a recovery phrase or private key into a chat or keep it as a screenshot.
- Never keep two antivirus products with live protection active together.
- Do not move cryptocurrency from a PC you doubt, however small the amount.
Questions about Clipboard virus
What is the clipboard virus?
It is malware that changes a cryptocurrency wallet address while it sits on your clipboard. When you copy an address and paste it into a wallet or exchange, the pasted text is one the attacker chose.
Kaspersky calls this a clipboard injector and ESET a clipper. The name "Clipboard virus" covers many different programs, among them CryptoShuffler in 2017, Android/Clipper.C in 2019 and the Tor Browser clipper of 2022 and 2023.
It shows nothing on screen, needs no internet connection to do its swap and works only when an address is copied. The loss is the transfer that you confirm yourself, and it cannot be reversed afterwards.
How do I know if my PC has a clipboard hijacker?
You usually do not know, and that is why it is dangerous. The one check Kaspersky gives is to type a made-up Bitcoin-style address into Notepad, copy it and paste it into a new line: if the text changes, a clipper is active. Try one address for each coin format you use.
A test that stays unchanged does not clear the PC, because the malware may watch only other formats. Each time you pay, compare the start, middle and end of the pasted address with the one you copied. Run a full scan with Microsoft Defender and Defender Offline as well, and look at Startup apps for names you cannot place.
Can I get my cryptocurrency back?
Probably not, and no one can promise otherwise. Blockchain transfers are final, which Kaspersky calls irreversible, and our old guide said the same. Your best chance is to act fast:
- write down the transaction ID
- the time and both addresses
- contact the exchange or wallet provider you sent from
- report the loss to the police
If the thief's address belongs to an exchange, that exchange may be able to freeze the account if the police ask in time. Be wary of anyone who offers to recover the coins for a fee, since that is a second fraud, and keep all addresses private when you ask for help online.
How does a clipboard virus get on a computer?
The victim runs it. In the cases we read, the file was a trojanized installer from a third-party download site or torrent, such as a copy of Tor Browser, or a fake copy of Telegram or WhatsApp, found through an advert or a lookalike website.
Our 2019 guide also named spam emails with DLL or EXE attachments, cracked programs and fake updates, which we keep as the old claim without a newer source. Kaspersky's advice is to download software only from reliable sources, because the official Tor installers it checked were signed and clean.
How do I remove the clipboard virus from Windows?
Disconnect the PC, copy your documents to a drive, then start Windows in Safe Mode with Networking and run a full scan in Windows Security. Afterwards run Microsoft Defender Offline from the same Scan options page, and uninstall programs you did not knowingly install, especially copies of Tor Browser, Telegram or WhatsApp that did not come from their makers.
If you hold cryptocurrency on the machine, reset Windows with Remove everything, because Kaspersky says a compromised device should not be trusted until it is rebuilt. We have not tried these steps on a live infection; they follow Microsoft's pages.
Can a clipboard hijacker infect an Android phone or a Mac?
On Android, yes. ESET found Android/Clipper.C on Google Play in February 2019 and trojanized Telegram and WhatsApp apps for Android and Windows in March 2023. It describes the first Android clipper as sold on underground forums in August 2018.
We found no clipper for iPhone or Mac in the sources we read, so we do not claim that none exists. On a phone, install apps only from the official store after checking the maker's own site for the link, uninstall any app you did not mean to install and run a Play Protect scan.
Will an antivirus scan or Windows Defender find it?
It can, and it often does. Kaspersky says that despite all attempts to evade detection the malware will be discovered, and the scanner list in our 2019 picture shows about 20 products flagging one sample.
But the same report explains why detection is hard for a clipper: it makes no network calls and acts only when an address is on the clipboard.
A clean scan is therefore one piece of evidence and not proof. Combine it with the Notepad test, a look at Startup apps and a check of every pasted address, and rebuild the device if you cannot be sure.
Which cryptocurrencies does it target?
Any with a recognisable address format. The 2023 Tor Browser clipper that Kaspersky took apart had rules for Bitcoin, Litecoin, Dogecoin, Monero and ERC-20 addresses, the last of which covers Ethereum, Tether and other tokens. CryptoShuffler in 2017 also targeted Zcash and Dash, and Bitcoin was its most profitable target.
Our 2019 guide named only Bitcoin and Ethereum, which was too narrow. Kaspersky wrote that the technique is attractive because a wallet address is the same everywhere, unlike a bank transfer that needs many correct fields.
How can I send cryptocurrency safely if clippers exist?
Never trust the paste. After pasting, read the start, the middle and the end of the address against the original in the wallet's own confirmation screen, preferably on a second device, and for a large first payment send a small amount and have the recipient confirm it.
Keep recovery phrases out of the clipboard and screenshots. Download wallets and messengers only from the maker's official site or store, and keep real-time protection on. These steps come from ESET's advice to check what you pasted and from our own reading of the attack, and no one of them is a guarantee.
Will Fortect remove Clipboard virus?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Clipboard virus, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Kaspersky Securelist: Copy-paste heist or clipboard-injector attacks on cryptousers (March 2023) (read October 6, 2026)
- Kaspersky official blog: CryptoShuffler Trojan has quietly stolen $140,000 worth of Bitcoin (October 2017) (read October 6, 2026)
- ESET WeLiveSecurity: First clipper malware discovered on Google Play (8 February 2019) (read October 6, 2026)
- ESET: Trojanized WhatsApp and Telegram applications stealing crypto funds (16 March 2023) (read October 6, 2026)
- Microsoft Security Intelligence: Rozena threat search (read October 6, 2026)
- Microsoft Security Blog: In hot pursuit of cryware: Defending hot wallets from attacks (17 May 2022) (read October 6, 2026)
- Microsoft Support: Using the clipboard in Windows (read October 6, 2026)
- Microsoft Support: Windows startup settings (Safe Mode) (read October 6, 2026)
- Microsoft Support: System Restore (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline scan in Windows (read October 6, 2026)