Microsoft Details How a Crypto Clipper Running Since February 2026 Spreads via USB and Hides Behind Tor

Since Microsoft's Threat Intelligence team flagged this campaign's USB-based spread in its earlier disclosure, researchers have now published a full technical breakdown of how the malware actually operates once it's on a machine. The architecture is more sophisticated than a standard clipboard thief.

How the Infection Starts

According to Microsoft's Security Blog, the attack begins with a malicious Windows Shortcut (.LNK) file distributed on USB storage devices. When a user opens what looks like a normal document, they trigger a worm component that first checks whether the machine is already infected. If it's clean, the worm fetches the payload from a remote server.

The worm then scans connected USB drives for common document types: Word (.DOC), Excel (.XLSX), and PDF files. It hides the originals and replaces them with shortcut files carrying the same names. The next person who plugs that drive into a different machine and tries to open what looks like a spreadsheet gets infected. The Hacker News confirmed this propagation mechanic and noted that the worm also deploys scheduled tasks to maintain persistence for both itself and the stealer module.

The Clipboard Theft Engine

The clipper component is where the money moves. According to CyberInsider, the malware monitors clipboard contents approximately every 500 milliseconds. When it detects a cryptocurrency wallet address, it silently substitutes the attacker's address. The victim pastes what they think is their intended recipient's address and sends funds directly to the attacker.

Beyond address swapping, Microsoft found the malware actively searches for Ethereum private keys, Bitcoin Wallet Import Format (WIF) private keys, and cryptocurrency seed phrases. This is the difference between losing one transaction and losing an entire wallet.

The Tor Infrastructure

What makes this campaign harder to disrupt than typical clipper malware is the command-and-control setup. According to Microsoft's blog, the malware doesn't call back to a static IP address that defenders can block. Instead, it deploys a bundled Tor client—a renamed binary called ugate.exe—runs it in a hidden window, and routes all traffic through a local SOCKS5 proxy on localhost port 9050 to reach a hidden .onion service.

The malware generates a unique victim identifier and registers it with that hidden server. After registration, it enters a continuous polling loop, checking for operator instructions while simultaneously running clipboard surveillance. Microsoft describes this as turning a financially motivated stealer into a lightweight backdoor. The operators can push remote code execution commands to any registered machine.

Obfuscation and Anti-Analysis

CyberInsider reported that all components are heavily obfuscated. The installer is packaged with PyInstaller and protected with PyArmor. The JavaScript payloads use multiple layers of encryption with runtime decryption to resist analysis. Before doing anything, the malware checks for an active Windows Task Manager process and shuts itself down if one is found. It also attempts to create antivirus exclusions for its staging directories under `C:\Users\Public\Documents`.

According to Microsoft, the strongest behavioral signals for defenders are: script interpreters spawning suspicious child processes, localhost:9050 proxy connections, screen-capture commands inside PowerShell, and clipboard inspection activity. Microsoft Defender for Endpoint flags this activity under detections including "Suspicious JavaScript process" and "Possible data exfiltration using Curl."

The Strongest Counter-Argument

Some security practitioners argue that USB-based attack vectors are overhyped in enterprise environments where removable media policies are already enforced and endpoint detection is mature. That's a fair point for large organizations with funded IT departments. The problem is that this campaign has been running since February 2026 with no public attribution to a specific threat actor, which suggests it is successfully evading detection in enough environments to keep operating. USB drives remain ubiquitous in small businesses, manufacturing floors, healthcare settings, and personal use, and the social engineering here is simple: the shortcuts look exactly like the files they replaced.

What This Means Practically

Microsoft Defender Antivirus and Defender for Endpoint both detect components of this threat, according to Microsoft's blog. Organizations not running those products need to cross-check whether their endpoint solution covers WScript/ActiveX-spawned process chains and Tor proxy usage.

The unresolved question as of the time of publication: Microsoft has NOT attributed this campaign to a named threat actor or a specific country. No law enforcement action has been announced. The .onion-based C2 infrastructure remains active as far as the published research indicates, meaning the operators are still collecting from registered infections. Until attribution happens or the infrastructure is taken down, machines infected since February are potentially still reporting in.