This article exposes how malware-laced printer drivers from Procolored were used in a sophisticated supply chain attack to hijack cryptocurrency wallets and steal over $1 million in Bitcoin.
TL;DR: A major supply chain breach was discovered involving Procolored, a printer manufacturer that unknowingly distributed malware-laced drivers through its official website. The signed drivers contained a remote access trojan (XRedRAT) and a clipboard hijacker (SnipVex) designed to steal cryptocurrency by replacing wallet addresses. At least 9.3 BTC (over $1 million) were stolen before the threat was identified. This incident highlights the growing danger of printer malware attacks and the need for stricter controls over signed drivers and driver-based malware in trusted software channels.
Frequently Asked Questions
A recent revelation in the cybersecurity world has uncovered a troubling breach of trust: Procolored, a Chinese printer manufacturer, was found to have distributed official printer drivers embedded with malware directly from its own website. This malware included a sophisticated clipboard hijacker targeting cryptocurrency users, leading to the theft of nearly 9.3 BTC, valued at over a million dollars according to the current exchange rate. The case highlights growing concerns over supply chain integrity and the targeting of digital assets through seemingly trustworthy channels.
How Printer Hacking Attacks Work
The Procolored malware incident highlights a sophisticated printer hacking attack that exploited user trust in official software channels. In this case, attackers embedded malicious code into a digitally signed printer driver—software that users commonly download directly from a manufacturer’s website. Because the driver was signed, it bypassed many standard antivirus defenses and appeared legitimate.
Once installed, the driver delivered two key payloads:
- A remote access trojan (RAT) called Win32.Backdoor.XRedRAT.A, which gave attackers full control over the infected system.
- A clipboard hijacker known as SnipVex, which monitored copied data and silently replaced cryptocurrency wallet addresses with those controlled by the attackers.
This setup allowed the attackers to steal nearly 9.3 BTC, worth over $1 million, by redirecting funds during crypto transactions without the victims’ awareness. The attack is a textbook example of how compromised drivers can be weaponized to gain system access, exfiltrate data, and hijack sensitive operations like cryptocurrency transfers.
Signed Malware in Printer Drivers Enabled Crypto Theft
Cybersecurity researchers at G DATA identified the malware while scanning the driver files, which had been digitally signed and made available on the manufacturer’s own website. Two malicious components were found embedded in the driver:
- Win32.Backdoor.XRedRAT.A – a remote access trojan enabling full control over infected machines.
- SnipVex – a .NET-based clipboard stealer that monitors copied data and replaces cryptocurrency wallet addresses with ones controlled by the attacker.
This clipboard hijacking technique is especially dangerous in cryptocurrency transactions. Victims who copy a wallet address intending to send funds may unknowingly send them to an attacker instead.
Driver Malware Went Undetected for Over 6 Months
According to G DATA’s report, these infected drivers were available online for more than six months, during which time they were downloaded by an unknown number of users. Several models of printers were affected. The precise method of malware injection is not definitively confirmed, but early analysis points to either infected USB devices or compromises within the development environment as likely causes.
As of now, at least 9.3 BTC have been stolen through the malware’s clipboard hijacking function. The manufacturer has since removed the malicious files from their website and launched an internal investigation.
Expert View: How Signed Malware in Printer Drivers Steals Crypto
Matthew Stern, a licensed Private Detective and CEO of CNC Intelligence—a U.S.-based firm specializing in cybercrime investigations and digital asset tracing—commented on the implications of the incident:
“When malware is injected into trusted software like printer drivers, it becomes incredibly difficult for users—let alone basic antivirus software—to detect. This isn’t just a technical failure; it’s a breakdown of the software supply chain,”
said Stern.
“Clipboard hijackers like SnipVex are deceptively simple but devastating. We’ve seen cases where victims unknowingly transferred tens of thousands of dollars to attackers just by pasting an address.”
Stern also offered practical advice for cryptocurrency users and organizations:
“Always double-check the entire wallet address after pasting—not just the first and last few characters. When transferring large amounts, it’s best practice to have at least two people involved in the process, and to conduct a small test transfer first. These simple steps can make the difference between a successful transaction and irreversible loss.”
Malicious Drivers Show Why Signed Malware Can’t Be Trusted
While this case is notable due to the use of a signed and officially distributed driver, clipboard-stealing malware is not new. Tools like Styx Stealer, RedLine, and Raccoon have long targeted cryptocurrency users using similar tactics.
What makes this case so alarming is the trust users placed in the software source. Downloading drivers from an official vendor website is normally considered best practice. This incident shows that trust in digital signatures and distribution channels is no longer sufficient without strong internal security controls at the software development stage.
How to Protect Against Printer Malware and Driver-Based Attacks
In light of this incident, cybersecurity experts urge both users and organizations to adopt the following practices:
- Always verify file hashes and digital signatures—even from official sources.
- Monitor clipboard activity when handling sensitive information like crypto addresses.
- Always verify the full pasted wallet address, not just a few characters.
- Use reputable endpoint protection tools that detect clipboard and RAT-style malware.
- Reinstall the operating system if infection is suspected; some malware leaves persistent components.
- Implement strict controls over development and deployment processes to avoid unauthorized code insertion.
- When transferring large amounts of cryptocurrency, involve at least two people and conduct a small test transaction first.
Conclusion: Printer Malware and the Cost of Supply Chain Attacks
This incident involving malware-laced printer drivers demonstrates how trusted software channels can be used to deliver sophisticated and damaging threats. It also reinforces a hard truth for modern cybersecurity: no link in the supply chain can be taken for granted. As digital assets grow in value and adoption, attackers are evolving their tactics to exploit the weakest point in the software lifecycle—often the one least expected.
As Matthew Stern of CNC Intelligence put it:
“When millions of dollars in cryptocurrency can be redirected with a single paste command, no link in the security chain can be allowed to break.”
References: Investigating the Printer Malware and Driver-Based Attacks
- G DATA CyberDefense. Printer infected: Software downloads distributed malware for months. May 2025.
- BleepingComputer. Printer maker offered malware-laced drivers for months. May 2025.
- eSentire. XRed Backdoor: The Hidden Threat in Trojanized Programs. 2025.
- Cointelegraph. Bitcoin-stealer malware found in official printer drivers. May 2025.
Your name, comment, and timestamp will be public when you comment. We also store this data, which may be used for research or content creation per our Privacy Policy. By commenting, you consent to these terms.