Malware is capable of detecting when users copy a cryptocurrency address to the Windows clipboard. The malware works by replacing this address with one owned by its author. Palo Alto Networks says it detected this malware as the final payload of a malspam campaign targeting Japanese and American users. The infection chain is quite complex, but follows patterns seen last year with Dridex (banking trojan) and Locky (ransomware) campaigns. Users advised to double-check that the cryptocurrency payment addresses they copy-pasted are identical.
Source: https://www.bleepingcomputer.com/news/security/combojack-trojan-replaces-cryptocurrency-addresses-copied-to-windows-clipboard/