最近在折腾博客的时候，偶然发现自己复制的 Cloudflare 账户 ID 在粘贴的时候就变样了，即使这个账户 ID 藏在一段话的中间，也会被篡改！
全程火绒安全形同虚设，完全没有任何提示和拦截。
演示视频：
While tinkering with my blog recently, I happened to notice that the Cloudflare account ID I copied got altered when pasted — even when the ID was buried in the middle of a paragraph, it was still tampered with!
Huorong Security was completely useless throughout this whole ordeal, without any alerts or blocks whatsoever.
Demo video:
在发现这种情况的时候，我感觉情况不对，因为这种现象我在刷视频的时候看到过，知道这是某种恶意软件在劫持剪切板。它们的行为是检测用户复制的内容，如果发现是某些特定的敏感信息（比如账户 ID、密码、加密货币地址等），就会自动替换成攻击者指定的内容。
初步排查
为了确认问题，我启动了 Copilot 对系统进行扫描，试图定位可疑进程。
果然，Copilot 成功定位到了一个可疑进程。我随即在任务管理器中结束了它的运行。
再次测试后，剪切板被篡改的现象果然消失了！
我又去看了一下计划任务，又一次印证了 Copilot 的分析。
安全软件的无力
让我感到困惑的是，为什么我的安全软件对此毫无反应？
我首先使用火绒安全扫描了相关文件夹，结果显示没有任何威胁。
接着，我尝试使用 360杀毒进行扫描，结果依然是“安全无威胁”。
深入分析
此时，我开始意识到问题的严重性。如果这个病毒程序仅仅是监控剪切板内容而不联网，数据可能还算安全；但如果它会将剪切板数据转发到攻击者的服务器，那我的电脑就完全裸奔了。
这种潜伏式病毒比勒索病毒更可怕。
有幸我也中过勒索病毒😷
于是，我让 Copilot 对该软件的行为进行深入分析，试图确认是否存在网络通信的行为。
AI 分析了很长时间，最终得出一个模糊的结论：这是一个非常严重的病毒。
解决方案与后续
为了安全起见，我备份了病毒文件和 Copilot 的分析结果，并将其上传至 GitHub，供大家参考：
接下来，我决定重装系统。
在虚拟环境中，我再次下载了病毒压缩包。这次，Windows Defender 直接将其识别为木马病毒 Trojan:Script/Wacatac，并立即删除。
随后，我尝试在禁用 Windows Defender 的情况下，仅使用火绒安全进行测试，结果火绒安全依然毫无反应。
当我解压该压缩包时，Windows Defender 再次将其中的恶意文件 node_module.asar 删除。
通过查看 Windows Defender 的日志，我得到了以下链接，进一步了解了该病毒的详细信息：
同样，宿主机上的火绒安全依然没有任何反应。
最后，我再次演示了当剪切板中存在敏感信息时，内容被篡改的现象。
Lessons learned
- 认真对待安全软件的提示
Copilot 分析说我 1 月 14 号中毒，4 月 18 更新。
1 月 14 号太久远了，我已经不记得当时做了什么。但 4 月 18 号我有印象我正在研究下载 《黑神话 悟空》, 我还记得当时在 dodi 上尝试下载文件的时候，总是会下载到一个莫名其面的压缩包，我以为是下载站提供的应用程序，我尝试安装，火绒安全提示我危险，但我选择了忽略。随后，我意识到这个程序不是什么正经东西，我赶紧删除了它。没想到它已经潜伏在我的系统里了。
- Windows Defender 没有那么烦
在这次的横向对比中，Windows Defender 真是表现优异，我决定再次重装系统，但这次我不会禁用 Windows Defender 了。
When I discovered this, I felt something was off, because I had seen this phenomenon in videos I scrolled through — I knew it was some kind of malware hijacking the clipboard. Such malware monitors what users copy, and if it detects certain sensitive information (such as account IDs, passwords, cryptocurrency addresses, etc.), it automatically replaces it with content chosen by the attacker.
Initial Investigation
To confirm the problem, I asked Copilot to scan the system and try to locate suspicious processes.
Sure enough, Copilot successfully located a suspicious process. I immediately ended it in Task Manager.
After testing again, the clipboard tampering was indeed gone!
I also checked the scheduled tasks, which once again confirmed Copilot’s analysis.
The Impotence of Security Software
What puzzled me was: why did my security software react to none of this?
I first scanned the relevant folders with Huorong Security, and the result showed no threats.
Then I tried scanning with 360 Antivirus, and the result was still “safe, no threats”.
Deeper Analysis
At this point, I began to realize how serious the problem was. If the virus only monitored clipboard content without going online, the data might still be safe; but if it forwarded clipboard data to the attacker’s server, then my computer was completely exposed.
This kind of lurking virus is scarier than ransomware.
Unfortunately, I’ve been hit by ransomware too 😷
Got my computer infected while using the open-source project frp for intranet penetration
So I asked Copilot to analyze the software’s behavior in depth, trying to determine whether it performed any network communication.
The AI analyzed for a long time and eventually reached a vague conclusion: this is a very serious virus.
Solution and Follow-up
To be safe, I backed up the virus file and Copilot’s analysis results, and uploaded them to GitHub for everyone’s reference:
Next, I decided to reinstall the system.
In a virtual machine, I downloaded the virus archive again. This time, Windows Defender immediately identified it as the trojan Trojan:Script/Wacatac and deleted it on the spot.
Then I tried testing with only Huorong Security while Windows Defender was disabled — Huorong still reacted to nothing.
When I extracted the archive, Windows Defender deleted the malicious file node_module.asar inside it again.
By checking the Windows Defender logs, I got the following link, which gave me more details about this virus:
Windows Defender threat description
Likewise, Huorong Security on the host machine still reacted to nothing.
Finally, I demonstrated once more how content gets tampered with when sensitive information is present on the clipboard.
Lessons Learned
- Take security software warnings seriously
Copilot’s analysis said I was infected on January 14th, with the virus updated on April 18th.
January 14th is too far back — I don’t remember what I was doing then. But April 18th rings a bell: I was researching how to download 《Black Myth: Wukong》. I remember that when trying to download files from dodi, I kept downloading a strange archive. I thought it was an app provided by the download site, so I tried to install it. Huorong warned me it was dangerous, but I chose to ignore it. Later, I realized this program wasn’t legit, and I quickly deleted it. I never expected it had already been lurking in my system.
- Windows Defender isn’t that annoying
In this head-to-head comparison, Windows Defender really performed admirably. I’ve decided to reinstall the system again, but this time I won’t disable Windows Defender.
