Hackers Distribute ClipBanker Malware via Fake Proxifier Installer On GitHub

### Executive summary A malicious GitHub repository masquerading as the Proxifier proxy utility delivers a trojanized installer that performs multiple evasive steps (temporary donor processes, Defender exclusion additions, injected .NET modules, obfuscated PowerShell stored in the registry, and scheduled tasks) to persist and fetch follow-on payloads; the final in-memory payload is ClipBanker, a C++ clipboard hijacker that replaces many cryptocurrency wallet addresses with attacker-controlled ones, and researchers observed over 2,000 detections largely in India and Vietnam.