The Proxifier Trap: The “Fileless” Marathon Stealing Your Crypto

Kaspersky researchers report a widespread campaign (since early 2025) that lures users searching for cracked ‘Proxifier’ software to malicious GitHub links; downloads trigger a multi‑stage, largely fileless infection chain (PowerShell scripts, registry persistence, process injection) culminating in a ClipBanker clipboard‑stealer that replaces cryptocurrency addresses to divert funds, affecting over 2,000 users—predominantly in India and Vietnam.