New Clipboard Hijacker Replaces Crypto Wallet Addresses with Lookalikes

It is highly recommended to avoid downloading executables from suspicious looking websites or running attachments received over email. These are the two of the most common methods of distributing malware, so avoiding these two actions can help prevent a user from being infected by most types of malware. It is also recommended to implement and maintain good security controls, such as an EDR, on all devices within an organization. Since Laplas appears to be distributed from other types of well-known malware, effective endpoint security products may be able to prevent the distribution malware from executing, thus preventing Laplas from even reaching the endpoint. If prevention does not occur, these malware families exhibit abnormal behavior that can be detected and alerted upon, allowing for an organization to know that there is a potential infection on a system. Finally, when copying and pasting cryptocurrency wallet addresses, it is highly recommended to compare the pasted value to the original side-by-side to verify it is the same address. Due to Laplas’ new technique of using similar looking addresses, checking a few characters in the pasted address is no longer sufficient. By doing a full side-by-side comparison, a user can make sure that the address is exactly the same as what they expect it to be, preventing them from potentially losing a large amount of cryptocurrency.

https://www.bleepingcomputer.com/news/security/new-clipboard-hijacker-replaces-crypto-wallet-addresses-with-lookalikes/

New Laplas Clipper Distributed via SmokeLoader