Lithuanian suspect arrested over KMSAuto malware that infected 2.8M systems

A Lithuanian national was arrested after allegedly distributing a trojanized KMSAuto activation tool containing clipboard‑stealing 'clipper' malware that monitored and replaced cryptocurrency addresses; the malicious installer was downloaded around 2.8 million times (2020–2023), was linked to ~8,400 fraudulent transfers from 3,100 wallets totaling approximately ₩1.7 billion, and investigators executed seizures and an extradition as part of an international probe.