Hackers are hiding malware in Microsoft Office add-ins to steal crypto wallets

From Cointelegraph

April 8, 2025 10:04 PM:

Malicious actors are using fake Microsoft Office extensions on SourceForge to steal crypto with malware, warns Kaspersky. The malware, ClipBanker, replaces copied crypto wallet addresses with the attacker’s. The infected system information is sent to hackers through Telegram. Kaspersky found the malware also scans for previous installations and antivirus software.

Kaspersky alerts users to avoid downloading software from untrusted sources. The malware disguises itself as legitimate software on SourceForge. The attackers could sell system access to other malicious actors. The malware is primarily targeting Russian-speaking users, with 90% of potential victims in Russia. Other firms have also raised alarms about new forms of malware targeting crypto users.

Read more at CoinTelegraph: Hackers hide crypto address-swapping malware in Microsoft Office add-in bundles