Device hygiene: updates, malware and clipboard hijacking

Why the device matters

A wallet, an exchange account or an e-mail inbox is only as safe as the phone or computer used to reach it. If that device is infected, an attacker can see what you type, read your files and change what appears on screen. Good device hygiene is not about expensive tools. It is a handful of routines that close the doors attackers use most often.

Updates come first

Security updates fix weaknesses that attackers already know about. Cybersecurity agencies such as the UK National Cyber Security Centre and the US CISA consistently put updates at the top of their advice for that reason.

• Turn on automatic updates for the operating system, the browser and your apps.
• Install updates through the device's own settings or app store, never from a pop-up on a website.
• If a device no longer receives security updates, avoid using it for anything involving money or keys.

Common kinds of malware

Information stealers

These programs quietly collect saved passwords, browser cookies, files and screenshots and send them to the attacker. They often search specifically for wallet files and anything that looks like a recovery phrase. They usually arrive in pirated software, game cheats, fake "cracked" tools or attachments.

Clipboard hijackers

Crypto addresses are long, so people copy and paste them. A clipboard hijacker watches for anything that looks like an address and replaces it with the attacker's own address at the moment you paste. The result looks normal unless you read it carefully. The defence is to compare the whole pasted address with the original, not just the first and last few characters, because some attackers generate addresses that match at both ends.

Remote-access tools

Legitimate screen-sharing and remote-control apps are often misused in scams. A fake support agent asks you to install one "to help". Once it is running, they can see and control everything you can. Only use remote access with someone you contacted yourself through an official channel, and never while a wallet or banking app is open.

Address poisoning

This trick needs no malware at all. An attacker sends a tiny transfer to your wallet from an address that looks very similar to one you use often. Later, when you copy a familiar address from your transaction history, you may pick the attacker's look-alike by mistake. Keep a trusted record of addresses you use regularly, and do not copy them from your history.

Browser extensions and apps

Extensions can read and change the pages you visit. Keep only the ones you really need, install them from links on the developer's official website, and remove anything you do not recognise. On phones, be cautious with apps that ask for accessibility permissions or the right to draw over other apps, because malware uses these to read the screen.

Everyday habits

• Use a screen lock with a PIN or passphrase, not a simple pattern.
• Keep the device's built-in security protection switched on.
• Do not install software from unofficial sources, and do not use "cracked" programs.
• Avoid using important accounts on shared or public computers.
• Consider keeping a separate user profile, or even a separate device, for financial activity.
• Back up your device regularly, but never include recovery phrases in a device backup.

Public Wi-Fi and shared networks

Most important websites and apps now encrypt their traffic, so public Wi-Fi is less dangerous than it once was. The bigger risks are fake networks with convincing names and login pages that ask for personal details. Prefer your mobile data connection for anything sensitive, and never install software or settings profiles that a public network asks you to install.

Before you pass on or repair a device

Old phones and laptops can hold more than you think: saved passwords, signed-in sessions, wallet files, photos and notes. Before you give a device away, recycle it or hand it in for repair, sign out of important accounts, remove wallet apps, and use the built-in option to erase the device completely and reset it to factory settings. If a device must be repaired while it still holds sensitive data, ask whether the repair can be done without your passcode, and change important passwords afterwards if you had to share it.

Signs something is wrong

Unfamiliar apps or extensions, settings that change by themselves, security protection that has been switched off, pasted addresses that differ from what you copied, or logins you do not recognise are all reasons to stop using the device for sensitive tasks and get it checked or reset.

This guide is general safety education. It is not financial, legal or security advice for your individual situation, and it does not recommend acquiring, holding or disposing of any crypto-asset. If you think you are dealing with fraud, contact your bank and the police.