A dangerous malware campaign has been silently targeting cryptocurrency users by hiding inside a fake version of Proxifier, a popular proxy software tool. <\/p>\n
Threat actors set up a GitHub repository designed to look like a legitimate Proxifier download, but the installer bundled inside it is actually a Trojan that monitors and hijacks clipboard activity to steal crypto wallet funds.<\/a><\/p>\n The attack begins in a very ordinary way. A user searches for \u201cProxifier\u201d on a popular search engine, and one of the top results points directly to the malicious GitHub repository. <\/p>\n The project page looks genuine \u2014 it even displays source code for a basic proxy service. In the Releases section, visitors find a downloadable archive containing an executable file and a text document with software activation keys, making the whole package appear trustworthy. <\/p>\n What the user does not know is that the executable is a malicious wrapper built around the genuine Proxifier installer.<\/p>\n <\/a>Securelist researchers identified this campaign<\/a> in early 2026, with analyst Oleg Kupreev noting that it had been active since the beginning of 2025. <\/p>\n The researchers described the infection chain as unusually long, with multiple layered stages designed to keep the malware hidden throughout the process. <\/p>\n Since early 2025, more than 2,000 users of Kaspersky security solutions have encountered this threat, with the majority of victims located in India and Vietnam.<\/a><\/p>\n ClipBanker is a clipboard-hijacking Trojan built specifically to go after cryptocurrency users. Any time a victim copies a wallet address \u2014 to send funds to someone, for instance \u2014 the malware silently swaps it out with an address owned by the attackers. <\/p>\n The threat covers more than 26 blockchain networks<\/a>, including Bitcoin, Ethereum, Solana, Monero, Dogecoin, TRON, Ripple, Litecoin, and many others, giving the attackers a very wide reach across different crypto ecosystems.<\/a><\/p>\n What makes this campaign particularly effective is how convincingly it is packaged. The attackers have been actively pushing their malicious GitHub repository up through search engine results, making sure more users find it. <\/p>\n A user downloading what appears to be free legitimate software would have no obvious reason to suspect anything \u2014 until their cryptocurrency silently disappears.<\/a><\/p>\n Once the user runs the trojanized installer, the malware gets to work immediately. Its first move is to create a small stub file \u2014 roughly 1.5 KB \u2014 in the system\u2019s temp folder, with a name that mimics a legitimate Proxifier process. <\/p>\n A .NET application called\u00a0 While the real Proxifier installer opens in the foreground to keep the victim calm and unsuspecting, the Trojan quietly continues working in the background. <\/p>\n It injects another module \u2014\u00a0 Through this process, an obfuscated PowerShell script<\/a> executes directly in memory, without leaving any visible trace on the hard drive. This fileless approach is what makes the malware so difficult to detect and remove in time.<\/a><\/p>\n The PowerShell script handles several key tasks: it adds PowerShell and conhost processes to Defender\u2019s exclusion list, stores an encoded script inside a registry key at\u00a0 The task reads the stored script, decodes it, and pulls the next payload from Pastebin-type services. <\/p>\n After one final download from GitHub, the shellcode is injected into\u00a0 To stay safe, users should download software only from official and verified sources. Running a reliable, up-to-date security solution is strongly recommended, as it can stop infections before they cause real damage. <\/p>\n If a paid security tool<\/a> is not an option, every download source should be carefully verified before any file is launched.<\/a><\/p>\n Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n The post Hackers Use Fake Proxifier Installer on GitHub to Spread ClipBanker Crypto-Stealing Malware<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n![\"Search](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgD-60m9EOVcOoWENp1NmhbFOU60CNMELBUIwBjir9EfNF3b3wk2XtCIFEetG2HlYf9hK3fUuQ_m9Lk43gsSAhVCTdWfBWdUDDmY-AbT2zGh3R9FXQefWD0R80e4onOSx7c3iJkA4Ba1HtpWZw1FNvjC9cq_sxB6HmW_oESbK3EtH81GZjy4l1xo8cvWsM\/s16000\/Search%2520results%2520showing%2520the%2520malicious%2520GitHub%2520repository%2520listed%2520among%2520the%2520top%2520results%2520for%2520%27Proxifier%27%2520%28Source%2520-%2520Securelist%29.webp?ssl=1\")
Inside the Infection Chain: How ClipBanker Evades Detection<\/strong><\/h2>\n
api_updater.exe<\/code>\u00a0is then injected into this stub to quietly add Microsoft Defender<\/a> exclusions for TMP files and the current directory. This step makes sure the following stages of the infection run without triggering any security alerts.<\/a><\/p>\nproxifierupdater.exe<\/code>\u00a0\u2014 which in turn pushes malicious code into\u00a0conhost.exe<\/code>, a trusted Windows system utility. <\/p>\nHKLMSOFTWARESystem::Config<\/code>, and registers a scheduled task named \u201cMaintenance Settings Control Panel\u201d that activates each time the user logs in. <\/p>\nfontdrvhost.exe<\/code>, where ClipBanker begins quietly watching the clipboard for any crypto wallet address to replace.<\/a><\/p>\n