Fake Proxifier GitHub Installer Spreads ClipBanker Crypto Malware

Hackers are abusing a fake Proxifier installer hosted on GitHub to deliver a multi‑stage ClipBanker malware that silently hijacks cryptocurrency transactions from infected systems.

The campaign combines search‑engine poisoning, trojanized installers, and fileless techniques to stay under the radar while swapping victims’ wallet addresses with those controlled by attackers.

The infection typically begins when users search the web for “Proxifier” or generic “proxifier” tools to tunnel app traffic through a proxy in locked‑down development or corporate environments.

Among the top search results is a GitHub repository that appears to host a simple proxy service, but its Releases section hides the real danger.

There, victims find an archive that includes a seemingly legitimate Proxifier installer and a text file with “free” activation keys, which helps lure users looking to bypass licensing costs.

The executable is actually a trojanized wrapper that runs the real Proxifier installer while silently launching a long, fileless infection chain in the background.

Since early 2025, more than 2,000 users of Kaspersky products have encountered this threat, with most detections observed in India and Vietnam, and around 70% identified via Kaspersky’s Virus Removal Tool on already‑compromised machines.

Proxifier GitHub Installer

Once executed, the Trojan first weakens Microsoft Defender protection by adding exclusions for all files with the TMP extension and for the directory where the installer is running.

After these exclusions are set, the wrapper launches the legitimate Proxifier installer so the user sees a normal installation, while the malware silently continues.

It does this by creating a tiny “Proxifier*.tmp” stub in the temp folder, then injecting a .NET binary called api_updater.exe into it, which runs an in‑memory PowerShell script via the PSObject class to avoid spawning visible consoles.

It spins up another donor process, injects proxifierupdater.exe, then abuses conhost.exe as yet another host to run a .NET component (“bin.exe”) that again executes obfuscated PowerShell in memory.

This PowerShell stage performs four key tasks: it adds PowerShell.exe and conhost.exe to Defender exclusions, writes a Base64‑encoded payload into the HKLM\SOFTWARE\System::Config registry key, creates a scheduled task that reads and decodes that registry data on a timer, and finally pings the IP‑logging service at hxxps://maper[.]info/2X5tF5 to report successful infection.

By keeping most logic in registry‑stored scripts and in‑memory execution, the actors minimize traditional file artifacts on disk.

The scheduled task launches PowerShell, which loads, decodes, and runs the registry‑stored script, then fetches the next script layer from hard‑coded Pastebin‑like services where the content is heavily encoded and obfuscated.

That script, in turn, downloads another large PowerShell payload from GitHub, roughly 500 KB in size, which mainly consists of a long Base64 string containing shellcode.

Final payload: ClipBanker crypto stealer

After decoding, the large PowerShell script extracts the shellcode, starts fontdrvhost.exe, injects the shellcode into it, and passes execution to this injected code.

The shellcode then unpacks the final payload: a classic ClipBanker‑style malware written in C++ with MinGW that focuses solely on clipboard manipulation.

This ClipBanker variant constantly watches the clipboard for strings matching cryptocurrency wallet formats for a wide range of networks including Bitcoin, Ethereum, Monero, Dogecoin, Solana, TRON, Ripple, Tezos, and many others.

Whenever it detects a wallet address, it silently replaces it with one of the attackers’ hard‑coded addresses, effectively redirecting outgoing transfers without any on‑screen warning or additional network communication from the stealer itself.

This shows many victims only discover the infection after the fact, highlighting the importance of proactive endpoint protection rather than relying on cleanup after damage is done.

This campaign reinforces a familiar lesson: downloading cracked or “pre‑activated” software from unofficial sources can easily lead to credential theft or direct financial loss, especially when cryptocurrency is involved.

Users should install software only from official vendor sites, avoid pirated license keys, and deploy reputable security solutions capable of blocking fileless attack chains and suspicious PowerShell behavior before funds are at risk.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.