Other report VR-B12CB5EA
Unverified report
Filed by a reader and not checked by anyone. It is an account of what happened to them, nothing more.
This report puts no risk label on the addresses below. Whatever PublicAML says about them, it says on its own evidence.
- Type
- Other
- Chain
- TRON
- Reported by
- Sharma
- Incident date
- Mar 31, 2026
- Published
- Nov 5, 2026
What happened
I searched for WhatsApp business apk file on google and eventually downloaded a zip file on computer system in which I have trust wallet chrome extension installed. When I opened zip file and double clicked on .exe file in it, something start running in background and I see nothing on screen suspicious. After an hour I copied and address from my WhatsApp and transferred 100k USDT TRC by pasting the same. After some time, I got complaint from recipient that funds have not arrived. After investigating I come to know that THERE IS A SILENT MALWARE (CLIPBOARD HIJACKER) RUNNING IN BACKGROUD WHICH REPLACES THE CORRECT ADDRESS COPIED TO CLIPBOARD WITH ATTACKER'S ADDRESS. Clipboard Hijackers: Silent malware that infects your computer or phone. When you copy a crypto address, the malware instantly replaces it in your clipboard with the attacker's address.
Addresses named in this report
- TF2Rb4oocjdN3LrTVbyvnjm2Cy8inwpwMgPerpetrator
- TMXi3UkmqoJawkquC3FYcsUfyYuAwnQpW9Perpetrator
- TFZ6hs27YBapxTetyeneCEPs5FBetcwLDvPerpetrator
Named here and believe it is wrong? Open the address page above and use the flag on the assessment. Every dispute is read.