Hackers Use Fake Proxifier Installer on GitHub to Spread ClipBanker Crypto-Stealing Malware

A multi-stage ClipBanker malware campaign has been distributing a trojanized Proxifier installer via a fake GitHub repository that appears legitimate; once executed it deploys a stealthy infection chain (Defender exclusions, process injection, fileless PowerShell, registry-stored payload and a scheduled task) and watches the clipboard to replace cryptocurrency wallet addresses across 26+ blockchains, resulting in reported infections (over 2,000 Kaspersky detections since early 2025), mainly affecting users in India and Vietnam.