Hacker arrested for KMSAuto malware campaign with 2.8 million downloads

South Korean police say a Lithuanian national distributed a malicious KMSAuto Windows/Office activator containing clipper malware that scanned and replaced cryptocurrency wallet addresses from victims' clipboards; an estimated 2.8 million copies were distributed (Apr 2020–Jan 2023), resulting in roughly KRW 1.7 billion stolen across thousands of transactions, seizures during a 2024 raid, and the suspect's arrest and extradition in 2025. Authorities warn against using unofficial activators which can carry malware.