Cybersecurity researchers have uncovered a sophisticated malware campaign using SourceForge, a popular software hosting platform, to distribute cryptocurrency miners and clipper malware disguised as cracked Microsoft Office applications.

According to Kaspersky’s recent report, threat actors created a seemingly legitimate project called “officepackage” on SourceForge that appears harmless at first glance, containing Microsoft Office add-ins copied from a genuine GitHub project.

The deception begins when users visit “officepackage.sourceforge.io,” which displays a list of Microsoft Office applications with download links in Russian. When hovering over these links, users see “loading.sourceforge.io/download” in their browser’s status bar, creating the illusion of legitimacy. However, clicking redirects victims to “taplink.cc” with another download button.

The infection chain involves multiple stages:
1. Users download a ZIP archive (“vinstaller.zip”)
2. Inside is a password-protected archive and a text file containing the password
3. The MSI installer within creates several files including UnRAR.exe and a Visual Basic script
4. The script executes PowerShell to download a batch file from GitHub
5. This batch file unpacks malicious files and runs additional scripts
6. System metadata is sent via Telegram API
7. Cryptocurrency miner and clipper malware are deployed
8. A netcat executable establishes an encrypted connection to a remote server

Telemetry data reveals 90% of the 4,604 potential victims between January and March were in Russia, suggesting the campaign specifically targets Russian-speaking users searching for Microsoft Office on Yandex.

Kaspersky also discovered a similar campaign distributing TookPS malware via fake websites impersonating the DeepSeek AI chatbot and other software. Additionally, malicious Google ads for RVTools have been found delivering ThunderShell, a PowerShell-based remote access tool.

While these attacks currently focus on cryptocurrency theft, researchers warn that compromised systems could potentially be sold to more dangerous threat actors.