Chinese printer manufacturer Procolored has come under fire after cybersecurity experts discovered that its official printer drivers were laced with malware designed to steal Bitcoin from unsuspecting users.
The Shenzhen-based company reportedly distributed the compromised drivers through both USB drives and cloud storage, exposing customers worldwide to significant financial risk.
Malware Embedded in Official Drivers
According to reports from Landian News and confirmed by cybersecurity firm SlowMist, the malware was embedded in Procolored’s official driver packages.
Once installed, the malicious software would monitor the user’s clipboard and, if it detected a Bitcoin wallet address, automatically replace it with an address controlled by the attacker.
Security researchers estimate that the malware campaign resulted in the theft of at least 9.3 BTC—worth over $950,000 at current prices.
The malware was present in drivers hosted on the file-sharing service MEGA, with infected files dating back as far as October 2023.
A Youtuber's Exposé
The issue first came to light when YouTuber Cameron Coward, while reviewing a Procolored UV printer, found his antivirus software flagging the drivers for containing a worm and a trojan virus.
After Procolored initially dismissed the warnings as false positives, Coward shared his findings on Reddit, prompting further investigation by cybersecurity firm G-Data.
G-Data’s analysis confirmed the presence of two distinct malware strains: Win32.Backdoor.XRedRAT.A, a remote access trojan, and a crypto-stealing clipboard hijacker.
The malware was traced to at least six Procolored printer models, with 39 compromised files linked directly from the company’s official support site.
Procolored’s Response and Supply Chain Compromise
Upon being contacted by G-Data, Procolored acknowledged the issue, stating that the infected drivers had been removed from their website as of May 8, 2025, and that all files were being re-scanned before re-uploading.
The company attributed the breach to a supply chain compromise, suggesting that the malware was introduced via infected USB devices used during the file transfer process.