MalwarePublished 9 Apr 2026

The long road to your crypto: ClipBanker and its marathon infection chain

Source AlienVault OTX General

clipbanker

Description

Proxifiers are speciaized software designed to tunnel traffic for programs that do not natively support proxy servers. They are a go-to for making sure these apps are functional within secured development environments. By coincidence, Proxifier is also a name for a proprietary proxifier developed by VentoByte, which is distributed under a paid license. If you search for Proxifier (or a proxifier), one of the top results in popular search engines is a link to a GitHub repository. That’s exactly where the source of the primary infection lives.

Impact

The malware can compromise systems by masquerading as legitimate proxifier software, potentially leading to theft or manipulation of cryptocurrency assets. There are no reports of widespread exploitation or known active campaigns beyond the initial infection vector. The infection chain complexity suggests persistence and evasion capabilities, increasing the risk to affected users who download the trojanized software.

Defensive guidance

Users should avoid downloading Proxifier software from unofficial or untrusted sources such as unverified GitHub repositories. Employing endpoint protection solutions that detect known ClipBanker hashes and monitoring for connections to identified malicious domains can help reduce risk. Since this is a malware infection vector rather than a software vulnerability, remediation focuses on user education and threat detection rather than patching.

Summary

ClipBanker malware is delivered through a trojanized Proxifier application hosted on GitHub, exploiting users searching for proxifier tools. Proxifier software is typically used to tunnel traffic for applications lacking native proxy support. The malware's infection chain is described as a marathon, indicating multiple stages or persistence mechanisms. The campaign targets cryptocurrency assets by compromising systems through this trojanized software. Indicators include multiple file hashes and domains related to the malware infrastructure.

Indicators of compromise

Domains 5

chiaselinks.com
rlim.com
git.parat.swiss
paste.kealper.com
pinhole.rootcode.ru

Hashes 7

107484d66423cb601f418344cd648f12
34a0f70ab100c47caaba7a5c85448e3d
7528bf597fd7764fcb7ec06512e073e0
8354223cd6198b05904337b5dff7772b
15efe7c0a510950c753a9ec1a388d699b341a2c4
d85cef60cdb9e8d0f3cb3546de6ab657f9498ac7
fdae784b02b22916bf4bac1344b3e8e13f98996e3cd85f2daf171084983247e1

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 9 Apr 2026, 18:36 UTC

Technical details

Indicators of compromise

Domains 5

Hashes 7

Community reviews

Related threats