Clipboard hijackers, keyloggers, and drainers — covered in our crypto malware types explainer — can only steal from a device they’ve already infected. Every attack starts the same way: malware needs a way in. Close the entry points and the attack never begins. This guide covers the infection vectors, how to recognise a compromised machine, and how to clean up.
The Infection Vectors
| Vector | How It Works | Risk Level |
|---|---|---|
| Fake downloads | Lookalike wallets, exchanges, and “update” installers that are malware | Very high |
| Cracked software | ”Free” copies of paid tools bundled with info-stealers | Very high |
| Phishing attachments | PDFs and Word docs with macros that install a payload | High |
| Malicious extensions | Browser extensions that read pages and intercept wallet activity | High |
| Malvertising | Malicious ads on legitimate sites | Medium |
| Supply-chain | Legitimate-looking apps or packages compromised at source | Medium |
| USB / juice jacking | Infected USB drives and public charging stations | Low-medium |
Fake Downloads and Fake Updates
The #1 way crypto users get infected. You search “MetaMask download”, click a sponsored ad, install “the app”, and restore your wallet with your seed phrase — you’ve just handed it over. The same trick works for fake exchange apps and “critical security update” popups; real wallet updates never arrive via an email link or a redirected website.
Protection: Download wallets and exchanges only from their official website, saved as a bookmark. Never click sponsored results or install updates from email links.
Cracked Software
Pirated games, “pro” tools, cracked wallets — attackers deliberately seed these with stealers that wait for you to log into an exchange. There is no such thing as a safe crack.
Protection: Use free or open-source alternatives. Never run pirated installers on any machine that touches crypto.
Phishing Attachments
Phishing emails pose as an invoice, tax document, or “trading report”. The attached PDF or Word file contains a macro that runs a payload the moment you open it. They’re personalised — attackers use your name and a plausible excuse.
Protection: Don’t open attachments from unexpected senders, and verify surprise invoices by phone or a known channel. A Word document demanding you “enable macros” is malware by definition.
Malicious Browser Extensions
Extensions requesting “read and change all your data on all websites” can intercept copied addresses, read pages you’re logged into, and inject drainer transactions. They use plausible names (“MetaMask Helper”, “Gas Tracker”) with a handful of installs.
Protection: Install extensions only from the official Chrome Web Store or Firefox Add-ons, from the verified developer. Review installed extensions regularly and remove anything unused.
Supply-Chain Attacks
The scariest vector: legitimate-looking code compromised at the source. Attackers plant malicious npm or PyPI packages, or hijack a project’s update server to push a poisoned release. Even “official” downloads can be infected.
Protection: Verify desktop wallet downloads with checksums and signatures (see Electrum’s signed releases).
Signs Your Device Is Compromised
| Symptom | Likely Cause |
|---|---|
| Clipboard pastes different addresses than you copied | Clipboard hijacker |
| New browser extensions you didn’t install | Extension malware |
| Random popups, redirects, changed homepage | Adware / browser stealer |
| Slow performance, fans constantly running | Miner or remote access trojan |
| Antivirus disabled or won’t update | Malware neutralising defenses |
| Outbound network traffic at odd hours | Data exfiltration |
| A wallet prompts for your seed phrase out of nowhere | Drainer |
The Cleanup Plan After an Infection
Act in this exact order — the sequence matters:
| Step | Action |
|---|---|
| 1 | Disconnect from the internet — unplug or toggle Wi-Fi. This cuts the data path immediately. |
| 2 | Move funds from a clean device. Use a trusted phone or friend’s laptop — create fresh wallets and transfer every balance out, without logging into anything sensitive. |
| 3 | Document what you can. Screenshot unusual transactions; note addresses and dates. |
| 4 | Boot a clean environment. Use a Linux live USB (or Tails) to copy only files you need — never wallet files. |
| 5 | Wipe and reinstall. A factory reset or fresh OS install is the only reliable cleanup. |
| 6 | Change all passwords and 2FA from the clean device — email first, then everything else. |
| 7 | Revoke token approvals on your old wallet with a tool like Revoke.cash, from a clean device. |
Prevention: Close the Doors
- Download wallets and exchanges from official, bookmarked sources only
- Never install cracked software; never open unexpected attachments
- Use an ad blocker and a reputable antivirus (Malwarebytes, Bitdefender, ESET)
- Keep the OS, browser, and extensions updated via official channels only
- Use a hardware wallet: keys never leave the device, so on-device malware has nothing to grab
- Verify checksums and signatures for any desktop wallet you install
Related: How to Recover a Hacked Account | Common Phishing Attacks | How to Create a Strong Security Plan
Bottom Line
Malware doesn’t teleport onto your device — it needs a door. Fake downloads, cracked software, phishing attachments, malicious extensions, and poisoned supply chains are the doors. Close them with official sources, ad blockers, and updates, and the clipboard hijackers and keyloggers have nothing to steal from. Already infected? Disconnect, move funds from a clean device, wipe, and change everything.