MAL-WALLET Crypto-Wallet Drainer and Clipboard Clipper

Two payloads aimed at crypto users: reading wallet key material and sending it off the machine, and watching the clipboard so a copied wallet address can be swapped for the attacker's.

What Vulkro detects

• MAL-WALLET-001 (drainer): code that reads a wallet key or seed (Keypair.fromSecretKey, a privateKey / secretKey / mnemonic / seedPhrase reference, a browser wallet-extension store path, or window.ethereum) within a few lines of a network egress call. A real key or seed export is High confidence; a bare window.ethereum read, which cannot export a key, is Medium.
• MAL-WALLET-002 (clipper): code that reads the clipboard (clipboardy, navigator.clipboard.readText, pbpaste, xclip, xsel) near a hardcoded crypto address (BTC 1 / 3 / bc1, or a 0x 40-hex ETH address). A normal copy button writes a runtime variable and does not match.

This is proximity, not data flow. A lone half never fires (a dapp legitimately reads window.ethereum). It scans JS/TS and Python and never certifies code safe.

How to fix

• Do not run the repository on a machine that holds wallet keys.
• If it already ran, move funds to a wallet whose seed that machine never saw.
• Verify the destination address at signing time instead of trusting the clipboard.

References

• OWASP A08:2021

See also: Confidence model.

---

This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.