Twizt, a new botnet variant using crypto clipping has been discovered by cyber threat intelligence provider Check Point Research.

Crypto clipping relies on malware to steal cryptocurrency during a transaction. The botnet employs malware that automatically replaces the intended wallet address with the address of the cybercriminal, so the funds are unknowingly hijacked.

Once deployed, Twizt, a new variant of the Phorpiex botnet, essentially acts on its own without any active command and control servers, which means the botnet can automatically widen its net by skirting past traditional security defences. Twizt has already stolen almost half a million dollars in cryptocurrency over a year, mostly from people in Ethiopia, Nigeria, and India, according to Tech Republic.

From November 2020 to November 2021, Phorpiex bots hijacked 969 cryptocurrency transactions, grabbing 3.64 Bitcoin (USD 179,000), 55.87 in Ethereum (USD 227,000), and USD 55,000 in ERC20 tokens. In its most profitable attack, the botnet snagged 26 in Ethereum (USD105,000), the online publication added.