According to researchers at Avast Security, a new campaign has been targeting people who are looking for hacking tools on Telegram channels. The HackBoss cryptocurrency malware has been using fake advertisements to trick users into downloading a simple user interface (UI), which they believe will give them hacking tools. Once the .ZIP file is downloaded, regardless of the options available, the UI’s main purpose is to decrypt and execute the cryptocurrency-stealing malware on the victim’s system. The malware is designed to check the clipboard of the victim’s system for a wallet address, and if one is found it quickly replaces it with one owned by the attackers. When the victim then initiates a cryptocurrency payment, they will be paying the owners of the HackBoss wallet address. Even after the UI is closed, the HackBoss malware continues to run.