LTC Security Alert: Hackers Exploit Fake Microsoft Office Add-Ons to Steal Cryptocurrency

In a recent cybersecurity revelation, hackers have been found embedding malware in fake Microsoft Office extension packages on SourceForge, targeting cryptocurrency users. The malware, known as ClipBanker, is designed to swap a victim’s copied wallet address with that of an attacker, leading to potential theft of digital assets like LTC. This development underscores the importance of vigilance in the crypto space, especially as malicious actors continue to devise sophisticated methods to exploit unsuspecting users. Below is a detailed summary of the incident and its implications for the cryptocurrency community.

Hackers Hide Malware in Fake Microsoft Office Add-Ons to Steal Crypto

Malicious actors have embedded malware in fake Microsoft Office extension packages on SourceForge, attempting to steal crypto by swapping a victim’s copied wallet address with that of an attacker. A cybersecurity report from Kaspersky’s Anti-Malware Research Team revealed that a listing titled “officepackage” contains genuine Microsoft Office add-ins bundled with hidden malware called ClipBanker. This malware is designed to hijack crypto transactions by swapping copied wallet addresses on a user’s clipboard with those controlled by the attacker. Crypto wallet users often copy wallet addresses rather than type them manually, making them vulnerable if their device is infected with ClipBanker.

The Best Trusted Cloud Mining Platform in 2025: DRML Miner

DRML Miner stands out as a reliable and profitable cloud mining platform. Certified by the UK Financial Services Authority (FCA), it offers secure, transparent, and sustainable mining of cryptocurrencies like Bitcoin (BTC) and Litecoin (LTC). With over 7 million users, DRML Miner has earned a stellar reputation. The platform’s mining contracts are among the most profitable, and its robust security measures make it a top choice for investors.

Malicious Actors Targeting Atomic and Exodus Wallet Users

A cybersecurity firm has uncovered a campaign where attackers compromised NPM libraries, distributing malware-laced packages to compromise private keys and drain digital assets. The malicious code scans for crypto wallets, injects harmful code, and alters wallet addresses during transactions to reroute funds to wallets controlled by the attackers. Affected wallets include Atomic and Exodus.