Efimer Trojan: From Fake Lawsuits to Crypto Heists

A large-scale cybercrime operation is leveraging phishing emails, compromised WordPress sites, and fake torrent downloads to distribute the Efimer Trojan, a stealthy cryptocurrency-stealing malware. Disguised as legal notices from major law firms, the emails pressure recipients over alleged domain trademark infringements to lure them into opening malicious attachments. Once active, Efimer hijacks clipboard data, swaps wallet addresses, and steals recovery phrases, using the Tor network for covert communication. Beyond phishing, the attackers brute-force WordPress admin credentials to host malicious payloads and harvest email addresses for future spam, targeting cryptocurrency users, website owners, and unwary downloaders alike.