Trojanized Proxifier Installer Deploys ClipBanker Through Fileless Infection Chain
Summary
Kaspersky researchers traced a trojanized Proxifier installer on GitHub through staged PowerShell, process injection and Defender exclusions to a ClipBanker that replaces copied cryptocurrency addresses. Kaspersky detected over 2,000 affected users, mainly in India and
Key points
- A GitHub release promoted in search results contained a malicious wrapper bundled with the legitimate Proxifier installer.
- The malware injected .NET components into donor processes to add Microsoft Defender exclusions and run obfuscated PowerShell in memory.
- A registry-stored, Base64-encoded script and scheduled task launched further stages downloaded from Pastebin-type services and GitHub.
- The final ClipBanker payload monitors copied cryptocurrency addresses and replaces them with attacker-controlled addresses across multiple blockchains.
- The ClipBanker payload does not establish persistence or connect to the network; an earlier stage beacons to an IP-logging service.
- Since early 2025, Kaspersky reported detections affecting more than 2,000 users, mostly in India and Vietnam; 70% came from its Virus Removal Tool.
Article Details
- Attack Vectors
- A trojanized Proxifier installer distributed through a GitHub Releases archive was promoted via search results; running it began the infection chain.
- The installer added Microsoft Defender exclusions, injected components and shellcode into donor and system processes, and ran obfuscated PowerShell in memory.
- A scheduled task read and decoded a Base64-encoded script stored in the registry, which downloaded further stages from Pastebin-type services and GitHub.
- The final payload monitored the clipboard for cryptocurrency wallet addresses and replaced them with attacker-controlled addresses.
- Defensive Notes
- Download software only from official sources and carefully vet software-download sites.
- Use reliable security solutions capable of preventing infection; the article emphasizes prevention over relying on cleanup after infection.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//chiaselinks[.]com/raw/nkkywvmhux | Raw-content URL listed among the services used to host infection-chain payloads. |
| URL | hxxps[:]//gist[.]github[.]com/msfcon5ol3/107484d66423cb601f418344cd648f12/raw/d85cef60cdb9e8d0f3cb3546de6ab657f9498ac7/upxz | Specific raw GitHub Gist URL listed as part of the infection-chain payload infrastructure. |
| URL | hxxps[:]//git[.]parat[.]swiss/rogers7/dev-api/raw/master/cpzn | Raw-content URL listed among the services used to host infection-chain payloads. |
| URL | hxxps[:]//github[.]com/lukecodix/Proxifier/releases/download/4.12/Proxifier.zip | Specific GitHub release archive identified as distributing the trojanized Proxifier installer. |
| URL | hxxps[:]//maper[.]info/2X5tF5 | IP logger URL contacted by the infection chain to signal successful infection. |
| URL | hxxps[:]//paste[.]kealper[.]com/raw/k3K5aPJQ | Paste service raw-content URL listed among the services used to host infection-chain payloads. |
| URL | hxxps[:]//pastebin[.]com/raw/FmpsDAtQ | Pastebin raw-content URL used to deliver a stage in the infection chain. |
| URL | hxxps[:]//pinhole[.]rootcode[.]ru/rogers7/dev-api/raw/master/cpzn | Raw-content URL listed among the services used to host infection-chain payloads. |
| URL | hxxps[:]//rlim[.]com/55Dfq32kaR/raw | Raw-content URL listed among the services used to host infection-chain payloads. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe infection chain uses obfuscated and multiply encoded scripts and payloads, including Base64-encoded content.T1053.005 · Scheduled TaskThe chain creates a scheduled task that launches PowerShell to decode and execute a script stored in the registry.T1055 · Process InjectionThe chain injects .NET components and shellcode into donor processes and utilities including conhost.exe and fontdrvhost.exe.T1059.001 · PowerShellObfuscated PowerShell scripts are decrypted and executed in-process using PSObject, and a scheduled task launches PowerShell for later stages.T1071.001 · Web ProtocolsThe malware downloads stages from web-hosted services and sends an infection-success beacon to an IP logger URL.T1102 · Web ServiceThe chain retrieves stages from Pastebin-type services and GitHub and contacts an IP logger.T1105 · Ingress Tool TransferScripts download subsequent scripts and payload stages from Pastebin-type services and GitHub.T1112 · Modify RegistryA Base64-encoded PowerShell script is stored in the HKLMSOFTWARESystem::Config registry key.T1115 · Clipboard DataThe final payload monitors the clipboard for cryptocurrency wallet addresses before replacing them.T1204.002 · Malicious FileThe infection begins when a user runs the trojanized installer distributed in a GitHub Releases archive.T1562.001 · Disable or Modify ToolsThe Trojan adds Microsoft Defender exclusions for TMP files, directories, and processes including powershell and conhost.
Malware
Vendors
Products
Kaspersky Virus Removal ToolSince early 2025, Kaspersky detections exceed 2,000 users (mainly India and Vietnam), with 70% of detections coming from the free Kaspersky Virus Removal Tool.Microsoft Defender Antimalware PlatformOn execution, the Trojan adds Microsoft Defender exclusions for TMP files and the installation directory by injecting a .NET component into a tiny temp donor process.ProxifierA malicious installer disguised as Proxifier on GitHub initiates a long, fileless infection chain that uses staged PowerShell execution, process injection, and Defender exclusions to deploy a ClipBanker clipboard
Countries
IndiaThe campaign has impacted over 2,000 Kaspersky users (mostly in India and Vietnam) and relies on Pastebin/GitHub-hosted payloads and beaconing to an IP logger.VietnamThe campaign has impacted over 2,000 Kaspersky users (mostly in India and Vietnam) and relies on Pastebin/GitHub-hosted payloads and beaconing to an IP logger.