86,000 Systems Hijacked: Sinkholing the Global CountLoader Clipper Operation

Security researchers have identified a sophisticated, large-scale CountLoader campaign characterized by layered obfuscation, multi-stage payload delivery, and resilient command-and-control (C2) architectures. This campaign is specifically engineered to deploy cryptocurrency clipper malware, aiming to hijack digital asset transactions by intercepting clipboard data.

What sets this threat actor apart is the complexity of the infection chain. By weaving together JavaScript, PowerShell, and in-memory shellcode execution, the malware achieves a high degree of stealth, effectively bypassing traditional signature-based detection and maintaining a persistent foothold on compromised endpoints.

The Infection Vector and Execution Flow

The attack lifecycle begins with the execution of a malicious binary that immediately triggers a PowerShell one-liner. This script is designed to download and decode a heavily obfuscated JavaScript loader. To bypass security controls, the loader is executed through mshta.exe, a legitimate Windows utility frequently abused in “Living off the Land” (LotL) attacks to evade detection.

Once the loader achieves execution, it establishes persistence via scheduled tasks and initiates communication with a distributed network of C2 servers. As noted in a report by McAfee Labs, the malware employs a resilient connection strategy: it attempts to reach out to C2 servers in reverse order, continuing until it successfully establishes a handshake with a live controller.

The payload delivery follows a meticulously orchestrated multi-stage process:

• JavaScript Loader (CountLoader): Facilitated via mshta.exe to initiate initial C2 contact.
• PowerShell Packer: Acts as a decryption engine to unpack subsequent stages.
• Injector: A critical module that disables security features, such as the Antimalware Scan Interface (AMSI), and injects malicious shellcode into legitimate system processes.
• Shellcode Execution: The malware transitions to a fileless state, loading the payload directly into memory.
• Final Payload: The malware masquerades under systeminfo.exe to execute the cryptocurrency clipper.

This fileless approach is a deliberate tactic to minimize the forensic footprint left on the disk, making it invisible to many standard antivirus solutions.

In a significant win for the defensive community, researchers identified a vulnerability in the C2 communication logic. By registering a backup domain (hell10-kitty[.]cc), they were able to “sinkhole” the traffic. Sinkholing allows researchers to redirect malicious traffic to a controlled environment, providing a real-time view of the infection scale without alerting the attackers.

Sinkholing malware communication (Source : McAfee Labs)

Through this sinkholing operation, the following metrics were observed:

• Connection Velocity: Approximately 5,000 infected systems connecting per minute.
• Global Infection Count: Roughly 86,000 unique infected machines.
• Geographic Distribution: While global, the highest density of infections was localized in India, followed by Indonesia, the United States, and various Southeast Asian nations.

Advanced Obfuscation and Propagation Mechanisms

The CountLoader campaign utilizes a custom-built encrypted protocol for C2 communications. To thwart network-level inspection, each message is encoded using a randomly generated six-digit key, combined with XOR operations and Base64 encoding. This makes identifying malicious patterns within encrypted traffic exceptionally difficult for standard Network Intrusion Detection Systems (NIDS).

Lateral Movement via Removable Media

Beyond network propagation, the malware spreads via USB drives. It employs a deceptive technique where it replaces legitimate files on a drive with malicious .LNK shortcuts. When a user attempts to open their file, the shortcut executes the malware first and then launches the original file, ensuring the user remains unaware of the compromise.

Infection Chain (Source : McAfee Labs)

The C2 infrastructure provides the attacker with a versatile toolkit, allowing them to:

• Remote execution of various file types (EXE, DLL, MSI, HTA, and PowerShell).
• Automated USB-based propagation.
• Exfiltration of detailed system and domain intelligence.
• Remote self-uninstallation to erase evidence during forensic investigations.

Telemetry suggests that USB-based propagation alone has accounted for nearly 9,000 infections.

Powershell Packer (Source : McAfee Labs)

The Final Objective: Cryptocurrency Theft

The ultimate goal of the CountLoader is the deployment of a cryptocurrency clipper. This malware monitors the system clipboard in real-time. When a user copies a cryptocurrency wallet address, the malware immediately swaps it with an address controlled by the attacker, leading to the direct theft of funds during a transaction.

To further evade detection, the malware employs EtherHiding—a technique that leverages blockchain platforms like Ethereum to store and retrieve C2 addresses. This makes the infrastructure highly resilient and difficult to block via traditional DNS filtering.

Furthermore, the malware conducts local reconnaissance to profile the infected system. It specifically searches for installed crypto wallets and browser extensions, allowing the threat actors to prioritize high-value targets for further exploitation. To ensure longevity, CountLoader uses scheduled tasks to re-execute every 30 to 60 minutes and features environmental awareness, modifying its behavior if it detects security software like CrowdStrike or Reason AV.

Indicators of Compromise (IOCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.