Hackers Exploit Fake Microsoft Office Software to Target Crypto Users

By: Eva Baxter

Cryptocurrency enthusiasts are facing a new threat as cybercriminals exploit open-source software platforms to distribute malware. Security experts have uncovered a scheme where attackers are embedding crypto mining and address-swapping malware in fake Microsoft Office extensions uploaded to SourceForge, a popular software hosting site. The sustained campaign is reportedly targeting users with a specific malware known as ClipBanker.

According to Kaspersky, a cybersecurity firm, these fraudulent Office packages appear legitimate at first glance, but within them lies a sophisticated method to redirect cryptocurrency transactions. The malware operates by modifying clipboard data, replacing a copied cryptocurrency wallet address with the attacker’s own address, resulting in unsuspecting victims inadvertently transferring their funds to illegitimate accounts. With over 4,600 incidents reported in the first quarter of 2025 alone, and most victims located in Russia, this attack highlights the critical importance of cybersecurity awareness among crypto users.

Researchers outline a complex attack vector where cybercriminals employ auto-generated subdomains and deploy numerous fake Microsoft Office tool pages. These pages, often indexed by search engines like Yandex, lead unsuspecting users to download what appears to be genuine software. However, the compressed files deceive users with their small size and consequently unpack into a much larger file, installing hidden scripts that can evade antivirus detection. These scripts then execute additional commands to load crypto mining software and ClipBanker trojans, posing a substantial risk to digital assets.

This situation underscores a broader issue of how malicious actors leverage trusted platforms like SourceForge to disseminate malware on a large scale without immediate detection. The ability to secretly load malicious code and data, paired with communication with remote systems such as Telegram bots for data exfiltration, exposes users to potential financial loss and privacy breaches. As the crypto realm grows, this incident serves as a cautionary tale for users to ensure they download software from official sources and maintain robust security protocols.