ClipBanker Malware Uses Marathon Fileless Infection Chain

Since the beginning of 2025, a sophisticated ClipBanker campaign has targeted users seeking the 'Proxifier' utility, primarily in India and Vietnam. Attackers distribute a trojanized wrapper through GitHub releases that appears to offer the legitimate tool along with activation keys. This serves as the entry point for a marathon infection chain designed to evade security software through fileless techniques and multiple stages of process injection.

The technical workflow involves several .NET injectors (api_updater.exe, proxifierupdater.exe, and bin.exe) that utilize the PSObject class to execute PowerShell scripts directly in memory. These scripts establish persistence through scheduled tasks and registry keys, eventually downloading a final C++ payload that monitors the system clipboard. The primary business impact is the automated theft of cryptocurrency by silently replacing user-copied wallet addresses with those controlled by the threat actor during transactions.

This campaign highlights the persistent risk of 'free' or 'cracked' software distribution sites and the increasing use of legitimate developer platforms like GitHub and Pastebin to host malicious infrastructure components. The complexity of the infection chain and the use of Microsoft Defender exclusions make it particularly challenging for standard antivirus solutions to detect without advanced behavioral monitoring.