KMSAuto Malware Campaign Leads to 2.8 Million Infections: Lithuanian Hacker Arrested
In early 2024, authorities arrested a Lithuanian national in connection with a large-scale malware campaign leveraging a trojanized version of KMSAuto, a popular software activation tool. The suspect is accused of distributing clipboard-stealing infostealer malware, which disguised itself as a utility for activating Windows and Office software. Over roughly two years, it is estimated that over 2.8 million downloads led to widespread infections, enabling the theft of sensitive data, including cryptocurrency wallet credentials, through malicious clipboard monitoring. This case highlights the persistent risk of malware-laden software masquerading as gray-market utilities, particularly where users bypass official software channels. The campaign demonstrates how threat actors continue to exploit user trust in widely circulated but unofficial tools, underlining the urgent need for supply chain vigilance and robust endpoint protection.
Kill Chain
