Hackers Use Fake Proxifier Installer on GitHub to Spread ClipBanker Crypto-Stealing Malware

Summary

Title: Hackers Use Fake Proxifier Installer on GitHub to Spread ClipBanker Crypto-Stealing Malware

Source: Cyber Security News

Date Published: [Not explicitly mentioned]

Author: [Uncredited]

---

Key Points:

1. Malware Distribution:

   • A fake installer for the legitimate Proxifier software has been uploaded on GitHub.
   • The malicious installer is designed to distribute ClipBanker malware, which steals cryptocurrency wallets.

2. Infection Mechanism:

   • The fake installer downloads and executes a PowerShell script from a remote server.
   • This script then installs ClipBanker, which runs in the background without user interaction.

3. Malware Features:

   • ClipBanker monitors clipboard content for cryptocurrency wallet addresses.
   • It replaces legitimate wallet addresses with those controlled by the attackers.
   • The malware also steals sensitive information such as API keys and private keys from various wallets like MetaMask, Phantom, and others.

4. Detection Evasion Techniques:

   • ClipBanker uses obfuscation techniques to evade detection by security software.
   • It also disables Windows Defender and other antivirus programs during its installation process.

5

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.