Software developers are the target. New trojan attacks supply chains and inflicts multifaceted damage on infected PCs

This report analyzes a multi‑stage supply‑chain trojan (phases: Trojan.DownLoader49.35384 → Trojan.DownLoader49.35687 → BackDoor.Siggen2.5906) that targets C++ and C# project files and executables to propagate. The malware performs credential and wallet theft, clipboard hijacking (to replace crypto addresses), remote backdoor operations, rogue cryptocurrency mining, and widespread infection of developer toolchain files (.vcxproj, .csproj, .suo, SDK headers, etc.). It uses advanced TTPs including PEB walking, initterm function hooking, GitHub/Steam-hosted C2 retrieval, DLL replacement, named pipes for inter-process communication, and a UAC bypass via registry and .vbs scripting; multiple URLs, mutex names, filenames and sample behaviors are provided as IoCs and mitigation guidance (update AV and scan downloads) is included.