This threat involves a malware campaign called Underground that uses an Aotera/Tedy loader to inject a Vidar-class stealer into Windows processes. The stealer targets cryptocurrency exchange accounts by injecting malicious scripts into Chrome and Edge sessions, enabling automatic theft via fake overlays and email manipulation. Additionally, a clipboard hijacker replaces legitimate cryptocurrency wallet addresses with attacker-controlled ones to divert funds. The campaign employs seven gate domains and rotates Cloudflare-fronted domains rapidly to avoid reputation-based detection. Infection starts with lure archives containing trojanized files and includes anti-analysis checks against 67 monitoring tools. The operation has stolen about $100,000 from hundreds of victims since October 2023.

The malware campaign results in direct financial loss to victims by stealing cryptocurrency from exchange accounts and wallets. It manipulates browser sessions and email communications to facilitate unauthorized withdrawals and converts stolen assets to Bitcoin, complicating recovery. The clipboard hijacking further increases the risk of fund diversion by replacing copied wallet addresses. Approximately 350-430 victims have been affected, with losses totaling around $100,000 across 23 blockchain networks.

No vendor advisory or official patch information is available for this malware campaign. Mitigation should focus on user education to avoid opening lure archives and trojanized files. Security teams should monitor for indicators of compromise such as the domains quick-neo.com and easybooters.com, and IP 95.164.53.76. Employ endpoint detection tools capable of identifying Aotera/Tedy loaders and Vidar stealers. Use multi-factor authentication on cryptocurrency accounts and verify wallet addresses manually rather than relying on clipboard contents. Due to rapid domain rotation, reputation-based detection may be insufficient, so behavioral detection and threat intelligence integration are recommended.