Hannibal Stealer Clipboard Hijacking for Cryptocurrency Address Replacement

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

This rule detects instances where specific processes (CefSharp.BrowsersSubprocess or SCef.WindowsAdapter) modify the clipboard content with strings matching common cryptocurrency wallet address patterns. This behavior is indicative of clipboard hijacking, where an adversary replaces a user's copied wallet address with their own to facilitate fraudulent transactions.