Loading threat actor…
RedLineCyber is a financially motivated cybercrime actor focused on stealing cryptocurrency through targeted social engineering and clipboard-hijacking malware. The actor operates primarily in Discord communities associated with gaming, gambling, cryptocurrency streaming, and related influencer ecosystems, where they cultivate trust over time by posing as a developer or security-tool provider. RedLineCyber has also been associated with a fake "RedLine Solutions" persona used to borrow credibility from the better-known RedLine malware brand. The actor’s intrusion approach centers on direct engagement rather than broad spam or phishing at scale. After building rapport with prospective victims, RedLineCyber privately delivers a malicious Windows executable presented as a streaming utility or wallet-protection tool. The payload is a Python-based clipper packaged for execution on systems without a native Python environment. Once launched, it persistently monitors the clipboard for cryptocurrency wallet addresses and replaces copied addresses with attacker-controlled alternatives at paste time, enabling theft when victims submit transactions. Reported targeting includes wallets associated with Bitcoin, Ethereum, Solana, Dogecoin, Litecoin, and Tron. Operationally, the malware is designed for stealth and simplicity. It uses persistence mechanisms to survive reboot, consumes minimal resources, and is described as operating with little or no command-and-control traffic, reducing opportunities for network-based detection. The malware’s narrow focus distinguishes it from broader information-stealing families: its primary purpose is real-time clipboard manipulation to redirect cryptocurrency transfers rather than credential harvesting or general host collection. Known aliases are limited to RedLineCyber, and the actor has been observed impersonating an affiliate relationship with "RedLine Solutions" as part of its social-engineering tradecraft.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 malware family attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Social-engineering-driven cryptocurrency theft operation in Discord communities using a Windows clipboard hijacker disguised as a streaming/security tool to replace copied wallet addresses with attacker-controlled addresses at paste time.
Cybercrime actor conducting crypto theft by infiltrating private Discord communities and using long-term social engineering to convince victims (notably crypto streamers/influencers) to install a Python-based clipboard hijacker ("clipper") disguised as a security/streaming utility (e.g., Pro.exe, peeek.exe). The malware monitors the Windows clipboard for cryptocurrency wallet addresses and substitutes attacker-controlled addresses, operating largely offline to reduce detection.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.