Microsoft and other security researchers have identified a sophisticated cryptocurrency clipper malware campaign that has been actively targeting users since February 2026. The malware, which Microsoft Threat Intelligence has dubbed Crypto Clipper, employs a multi-layered approach to evade detection and steal valuable digital assets from unsuspecting victims. This includes the use of Tor for covert communication with its command-and-control (C2) server, combined with a worm-like propagation strategy using USB storage devices.
The malware’s infection process begins when users open malicious shortcut (.lnk) files distributed on USB drives. These shortcuts trigger the execution of a staged worm component that scans connected USB devices for commonly used document types like Word, Excel, and PDF files. It then replaces these legitimate files with additional malicious .lnk files, effectively hiding the originals and creating a chain of infection. This propagation mechanism allows the malware to spread rapidly across connected systems.
Once executed, the clipper component monitors the clipboard every 500 milliseconds, actively searching for cryptocurrency wallet addresses or seed phrases. If it detects these sensitive details, it replaces them with attacker-controlled alternatives. The victim unknowingly transmits their funds to the threat actor’s wallet while believing they are sending them to their intended recipient.
To further enhance its stealth and persistence, the malware leverages Windows Script Host and ActiveXObject for remote code execution, establishes scheduled tasks to maintain its presence on the system, and creates Defender exclusions to avoid detection of its components. The C2 communication is facilitated through a bundled Tor client, utilizing a local SOCKS5 proxy to mask the attacker’s location and make it difficult to trace the malware’s activity.
The malware also exfiltrates screenshots and sensitive clipboard data, including private keys and seed phrases, to a hidden-service C2 server. Initial access is gained via malicious .lnk shortcut files, and all components are heavily obfuscated using techniques like PyInstaller and PyArmor, along with multiple layers of encryption.
Microsoft has advised security professionals to educate users about the risks of opening files from untrusted USB storage devices and to implement robust endpoint security measures to detect and prevent this evolving threat. Organizations should also review Defender exclusions and monitor for unusual scheduled task activity related to file propagation.
Sources: