Executive Summary
McAfee Labs has identified a large-scale CountLoader campaign involving approximately 86,000 unique infections globally, with significant prevalence in India and Southeast Asia. The malware utilizes a complex multi-stage infection chain involving PowerShell, obfuscated JavaScript, and shellcode injection to maintain a low profile while establishing persistence via scheduled tasks.
The campaign's primary objective is the deployment of a cryptocurrency clipper. This final payload monitors the victim's clipboard for wallet addresses and replaces them with attacker-controlled addresses to steal funds during transactions. Notably, the threat actor utilizes the 'EtherHiding' technique to retrieve C2 addresses from the Ethereum blockchain and propagates through USB drives by replacing legitimate files with malicious LNK shortcuts.
Researchers successfully sinkholed a backup C2 domain (hell10-kitty[.]cc), revealing that the infrastructure handles approximately 5,000 connections per minute. The malware's ability to adjust its behavior based on the presence of specific EDR solutions like CrowdStrike underscores the sophistication of its evasion tactics.