New Crypto Clipper Malware Uses JavaScript, PowerShell, and Shellcode

Key Takeaways

• A widespread cryptocurrency-stealing campaign, dubbed “CountLoader,” is actively compromising tens of thousands of machines globally.
• The malware employs a multi-stage infection chain leveraging JavaScript, PowerShell, and shellcode to deploy a sophisticated crypto clipper.
• Initial infections occur via malicious executables and USB drives, while the final payload retrieves its command-and-control server address from the Ethereum blockchain, making takedown efforts challenging.
• The clipper silently replaces copied cryptocurrency wallet addresses with attacker-controlled ones, rerouting transactions unnoticed by victims.

A sophisticated malware operation is currently targeting cryptocurrency users worldwide, employing a multi-layered attack chain to surreptitiously divert digital assets. Researchers have detailed a pervasive campaign centered around a loader known as “CountLoader,” which utilizes a combination of JavaScript, PowerShell, and shellcode to deliver a crypto clipper payload capable of intercepting and rerouting cryptocurrency transactions. This campaign has already compromised tens of thousands of systems across multiple continents, as revealed in a recent report.

The attackers do not rely on a singular method but rather a complex, multi-stage infection process designed for stealth and persistence. The initial compromise often begins with a malicious executable file. This EXE then initiates a PowerShell command, which in turn downloads an obfuscated JavaScript loader. This loader is then executed via mshta.exe, a legitimate Windows utility that threat actors frequently abuse due to its inherent trust within the operating system. This technique allows the malware to blend seamlessly with normal system activities, granting it time to establish itself before security defenses can react effectively.

According to analysts at McAfee Labs, who published a detailed report on the campaign, approximately 86,000 unique machines have been infected. The scale of the operation is evident in the telemetry data, which showed an average of 5,000 compromised systems connecting to the command-and-control (C2) infrastructure every minute. Geographically, India reported the highest number of infections, followed by Indonesia and the United States, with a significant presence observed across Southeast Asia.

Beyond internet-based delivery mechanisms, the malware also propagates through infected USB drives. Upon receiving instructions from its C2 server, CountLoader replaces legitimate files on connected external storage devices with malicious LNK shortcut files. When a user clicks on one of these shortcuts, it silently executes the malware while simultaneously opening the original, legitimate file, ensuring the victim remains unaware of the compromise. This USB-based propagation method accounted for roughly 9,000 infections.

Malware Campaign Delivered via Multi-Stage Attack Chain

The ultimate objective of this sophisticated attack is to deploy a cryptocurrency clipper. Once established in memory, the clipper operates in the background, continuously monitoring the user’s clipboard. The moment a cryptocurrency wallet address is copied, the malware intervenes, silently replacing the legitimate address with one belonging to the attacker. This enables the redirection of funds without any visible warning or indication to the unsuspecting victim.

The infection chain is meticulously engineered to evade detection at every phase. Immediately after the initial executable runs, a scheduled task is created, configured to trigger every 30 minutes. This ensures the malware maintains persistence on the system from the outset. The PowerShell script then decodes a Base64-encoded payload and executes it using Invoke-Expression, a prevalent technique that allows for the execution of hidden code without writing it to disk, thereby minimizing forensic artifacts.

CountLoader subsequently assumes control as an HTA file, loaded and executed through mshta.exe. It operates with a hidden window, attempts to self-delete if run locally, and cycles through a list of command servers until a connection is established. Once connected, it performs an encrypted handshake, retrieves a JSON Web Token (JWT), and transmits detailed information about the compromised host back to the attackers, including any detected cryptocurrency wallets or browser extensions.

Further stages involve a PowerShell packer, which decrypts and launches a shellcode injector. Crucially, before injecting the shellcode, the script employs a publicly known bypass to disable AMSI (Antimalware Scan Interface), a Windows feature designed to detect malicious scripts. The shellcode then loads the final clipper payload directly into memory under the legitimate systeminfo.exe process, ensuring it never touches the disk. This in-memory execution significantly complicates detection by conventional security tools.

Cryptocurrency Clipper Delivered via EtherHiding

A notable aspect of the final payload is its method for locating its command server. Instead of relying on a hard-coded domain name, which could be easily blocked or taken down, the clipper leverages a technique known as EtherHiding. This method involves retrieving the C2 server address directly from the Ethereum blockchain. The decentralized nature of the blockchain means there is no single point that defenders can target to disrupt the malware’s communication infrastructure.

After successfully retrieving the server address, the clipper begins its primary function: silently monitoring clipboard contents for cryptocurrency wallet addresses. It supports a wide array of cryptocurrency formats, including Bitcoin, Ethereum, and others, allowing it to seamlessly swap addresses without the victim’s knowledge. The true scope of this campaign was assessed by researchers who registered a backup C2 domain and successfully sinkholed infected traffic, effectively observing the attackers’ infrastructure in action.

What You Should Do

• Exercise Caution with Executables: Never run executable files (.exe) from untrusted sources, especially those received via email or downloaded from suspicious websites.
• Be Wary of USB Drives: Treat unknown or untrusted USB drives with extreme caution. Avoid plugging them into your system, and if you must, scan them thoroughly with up-to-date antivirus software before opening any files.
• Verify Wallet Addresses: Always double-check and verify cryptocurrency wallet addresses before confirming any transaction. Manually compare the copied address with the intended recipient’s address.
• Monitor Scheduled Tasks: Regularly review scheduled tasks on Windows systems for any unfamiliar or suspicious entries.
• Maintain Up-to-Date Security Software: Ensure your antivirus and endpoint detection and response (EDR) solutions are always updated with the latest definitions and patches to detect emerging threats.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.