Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Efimer Trojan is spreading through compromised WordPress sites, malicious torrents, and email campaigns impersonating lawyers. It steals cryptocurrency by replacing wallet addresses in the clipboard and can execute additional malicious scripts. The Trojan communicates with its command-and-control server via the Tor network. It has additional capabilities to brute-force WordPress sites and harvest email addresses for further distribution. The malware primarily targeted users in Brazil, India, Spain, Russia, Italy, and Germany between October 2024 and July 2025, affecting over 5,000 Kaspersky users.

The Efimer Trojan is a multifaceted malware strain actively spreading through compromised WordPress websites, malicious torrent files, and targeted email campaigns impersonating legal professionals. Its primary malicious function is to steal cryptocurrency by intercepting and replacing wallet addresses copied to the clipboard, a technique known as clipboard hijacking. Beyond this, Efimer can execute additional malicious scripts, enhancing its persistence and capabilities. Communication with its command-and-control (C2) infrastructure is conducted over the Tor network, which anonymizes traffic and complicates detection and takedown efforts. The Trojan also incorporates brute-force attack capabilities aimed at WordPress sites, attempting to gain unauthorized access by guessing credentials. Additionally, it harvests email addresses from infected systems to expand its distribution via phishing campaigns. The malware has been observed targeting users predominantly in Brazil, India, Spain, Russia, Italy, and Germany from October 2024 through July 2025, impacting over 5,000 users monitored by Kaspersky. The attack vectors leverage common web application vulnerabilities and social engineering, exploiting WordPress’s widespread deployment and the trust users place in email communications from purported legal entities. The use of the Tor network for C2 communication and the combination of multiple infection and propagation methods make Efimer a persistent and evasive threat. Although no specific affected software versions are listed, the brute-force attacks on WordPress suggest exploitation of weak credentials or unpatched installations. The malware’s tactics align with several MITRE ATT&CK techniques, including clipboard data theft (T1115), command execution (T1059.007), phishing (T1566.002), brute forcing (T1110), and use of anonymizing networks (T1571).

Detailed information about Efimer Trojan delivered via email and hacked WordPress websites. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'email campaign'

Filter Threats

Threats Tagged 'email campaign'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility