Malware Campaign Uses JavaScript, PowerShell, and Shellcode to Deliver Crypto Clipper

Researchers uncovered a large-scale CountLoader campaign that uses a multi-stage EXE → PowerShell → mshta/HTA → shellcode chain to deploy an in-memory cryptocurrency clipper which monitors and silently replaces wallet addresses; infections (≈86,000 unique machines, heavy activity in India, Indonesia, US) spread via internet and USB, use scheduled tasks and AMSI bypasses for persistence/stealth, and retrieve C2 addresses via the Ethereum blockchain (EtherHiding). The report includes detailed IoCs (hashes, domains, URLs) and mitigation advice.