Lithuanian suspect arrested over KMSAuto malware that infected 2.8M systems

A Lithuanian national, aged 29, was arrested for allegedly spreading KMSAuto-based clipboard-stealing malware that infected about 2.8 million Windows and Office systems, according to the report. The suspect was extradited from Georgia to South Korea under Interpol coordination, with authorities saying he trojanised the KMSAuto piracy tool to distribute clipper malware that monitored victims’ clipboards for cryptocurrency addresses and replaced them with attacker-controlled wallets.

The Korean National Police Agency notes that the malware caused 8,400 transfers from 3,100 wallets, worth about 1.7 billion won in total. Eight South Korean victims were confirmed to have suffered losses of about 16 million won. Investigators traced infections to pirated software, and the case involved an international operation targeting exchanges and companies across six countries, leading to the arrest and device seizures with an Interpol red notice.