CyberArk researchers have uncovered a sophisticated malware campaign delivering a previously undocumented clipper malware called MassJacker. This malware specifically targets users searching for pirated software online.

## How MassJacker Works

The infection begins at pesktop[.]com, a site masquerading as a pirated software repository. The attack chain involves:

1. An initial executable that launches a PowerShell script
2. Delivery of Amadey botnet malware alongside two .NET binaries (32-bit and 64-bit versions)
3. A component called PackerE that downloads an encrypted DLL
4. The DLL loads a second DLL that injects the MassJacker payload into the legitimate Windows process “InstalUtil.exe”

MassJacker employs advanced evasion techniques including:
– Just-In-Time (JIT) hooking
– Metadata token mapping to hide function calls
– Custom virtual machine for command interpretation
– Anti-debugging protections

## Cryptocurrency Theft Mechanism

As a clipper malware (or “cryware”), MassJacker:
– Monitors clipboard content for cryptocurrency wallet addresses
– Creates an event handler that activates whenever the victim copies text
– Uses regex patterns to identify wallet addresses
– Automatically substitutes the victim’s copied wallet address with an attacker-controlled one

## Financial Impact

Researchers identified:
– Over 778,531 unique attacker-controlled addresses
– 423 addresses containing approximately $95,300
– Total assets of around $336,700 held in these wallets before transfers
– A single wallet containing about $87,000 (600 SOL) with over 350 incoming transactions

While the threat actors remain unidentified, code analysis reveals similarities with another malware called MassLogger, which uses similar JIT hooking techniques to evade detection.