Hackers Deploy Crypto Clipper Using JavaScript and PowerShell Payloads

CountLoader is a multi-stage malware campaign that uses an initial malicious EXE to run obfuscated JavaScript and PowerShell (via mshta.exe) to deploy a cryptocurrency clipper that hijacks clipboard wallet addresses; the chain includes AMSI bypass, in-memory injection, USB propagation, and dynamic C2 retrieval via the Ethereum blockchain, and McAfee sinkholing observed roughly 86,000 unique infected machines with numerous IoCs provided.