Scammers mass-mailing the Efimer Trojan to steal crypto

Kaspersky describes the Efimer campaign: a ClipBanker/infostealer that spreads via malicious email attachments, compromised WordPress sites and torrent lures, installs a Tor proxy for C2, replaces copied cryptocurrency wallet addresses and exfiltrates mnemonic seeds and screenshots; the threat includes additional modules for WordPress brute-force and email harvesting, with multiple file hashes, onion C2 URLs, and ~5,015 affected Kaspersky users (highest activity in Brazil).