CountLoader Malware Weaponizes EtherHiding to Deploy Stealth Crypto Clippers

McAfee Labs uncovered a large CountLoader campaign that uses obfuscated JavaScript and staged PowerShell loaders to execute payloads in memory, disable AMSI, inject shellcode into legitimate processes, and deploy a cryptocurrency clipboard-clipper that swaps victim wallet addresses; operators fetch C2 via an Ethereum-based technique and researchers sinkholed a backup domain after thousands of infected hosts phoned home.