Attackers distributing a miner and the ClipBanker Trojan via SourceForge

This report describes a criminal campaign that abused SourceForge-generated sourceforge.io subdomains to present fake software downloads that install a large MSI which, through layered archives and scripts, extracts and runs AutoIt-based payloads: a cryptominer and ClipBanker (clipboard‑stealer). The malware performs reconnaissance (Telegram exfil of system info), establishes persistence via services, registry App Paths and WMIC event filters, and provides remote access via an encrypted netcat connection to apap.app:445; telemetry shows ~4,604 affected users (≈90% in Russia).