Double-check all addresses before hitting send. Just saved a friend from a clipboard malware.

So today, I wanted to introduce a friend to a certain cryptocurrency and asked him to copy-paste his metamask and send it to me via chat. Having this constant paranoia and fear of sending crypto to wrong addresses, I decide to look up the address he sent to me on etherscan, and I find quite a large balance with many transactions. I make a joke to my friend about how rich he was, but he tells me that he has a 0 balance. That was when the alarm bells started going off in my mind. I ask him to take note of the first two and last two characters in his ethereum address, copy it, and then paste it to me. He tells me the address changed when it was pasted from the windows clipboard. To be double sure, I ask him to make up a random set of numbers and letters of length 42, then copy and paste it in our chat.The fake addressthat was pasted changed.

My suspicions were right.

In short, his computer was infected by the colormania malware that targets the windows clipboard. This malware checks whether a copied text has a particular length that is common to some blockchains and replaces the text or address, in this case, with the attacker's address. So when you hit paste and click the send button, the address changes and the funds are sent to the attacker instead. We found evidence of the malware at the task manager's background processes. And lo and behold, we found colormania running in there. I had him download and install Malwarebytes, which found several threats on his system and cleared it. Now, the values of addressed copied onto the clipboard no longer changed when he pasted them. I guess the moral of this is to double check addresses whenever sending cryptocurrency.

Always stay paranoid

This is one of the attacker's ethereum address: 0x51e199f1ec3030B4610007C29ab3D272af91Dfd6