Windows Crypto Clipper Malware Has Spread via USB Drives Since February 2026, Microsoft Says

What the Malware Does

The threat is a Windows-based cryptocurrency clipper — software that sits silently on an infected machine, monitors the clipboard every 500 milliseconds, and replaces any copied cryptocurrency wallet address with one controlled by the attacker. When a victim copies a wallet address to paste into a transaction, the malware swaps it out. The money goes to the attacker.

Clipboard-hijacking for crypto theft has been around for years. What makes this campaign notable, according to Microsoft's Defender Security Research Team, is the infrastructure behind it.

Instead of contacting a traditional command-and-control server over an exposed IP address, the malware deploys a portable Tor client, routes traffic through a local SOCKS5 proxy at localhost:9050, and communicates exclusively with a .onion hidden service. There is no IP address to block. There is no traditional installer to flag. The malware generates a unique victim identifier, registers with the Tor-hosted server, and then enters a continuous polling loop, waiting for instructions while stealing in the background.

Beyond wallet substitution, the clipper harvests seed phrases and private keys, takes screenshots, and exfiltrates them. It also accepts remote code execution commands from the C2 server, which Microsoft notes effectively turns a financially motivated stealer into a lightweight backdoor.

How It Spreads

The infection vector is a malicious Windows Shortcut (.LNK) file distributed via USB drives, according to The Hacker News, which reported on Microsoft's analysis published Tuesday, June 17.

When a user plugs in an infected USB device and opens what looks like a normal document, they are not opening a document. The LNK file executes a worm component instead. That worm first checks whether the machine is already infected. If it is not, it fetches the payload from the remote server.

The worm then scans the USB drive for common file types, including .DOC, .XLSX, and .PDF files. It hides the real files and creates new LNK shortcuts using the exact same file names. Anyone who later uses that USB drive on another machine and tries to open those "documents" triggers the infection chain again.

Persistence is handled through scheduled tasks, one for the worm component and one for the stealer, so both survive reboots without requiring elevated privileges at install time.

The malware also includes basic evasion: it checks whether Task Manager is running and exits if it is.

Microsoft's Detection and Recommended Defenses

Microsoft's Defender Antivirus detects the threat as Trojan:Win32/CryptoBandits.A. Microsoft Defender for Endpoint flags behavioral indicators including suspicious JavaScript child processes and possible data exfiltration using Curl.

ChainCatcher, which covered the disclosure on June 19, summarized Microsoft's recommended mitigations: disable autorun for removable devices, restrict script interpreter execution permissions, and monitor for localhost:9050 Tor proxy traffic and abnormal clipboard access.

The behavioral signals Microsoft considers strongest are: script interpreters spawning unusual child processes, localhost:9050 proxy connections, screen-capture commands in PowerShell, and evidence of clipboard inspection or crypto-address replacement.

The Legitimate Concern Worth Taking Seriously

Some security researchers argue that flagging all Tor usage at the network level is a blunt instrument that could interfere with legitimate privacy tools. Journalists, activists, and ordinary users have valid reasons to run Tor. The specific signature here, however, is a combination of factors: a hidden Tor binary running in a concealed window, clipboard polling at 500-millisecond intervals, screenshot capture, and exfiltration via Curl, all triggered from a script interpreter. No single indicator proves infection; the pattern does. Microsoft's guidance targets the cluster of behaviors, not Tor itself.

What Is Still Unknown

Microsoft has not publicly attributed this campaign to a specific threat actor or country of origin. The company has not disclosed how many machines have been confirmed infected since February 2026, nor has it specified which cryptocurrency networks are most heavily targeted by the wallet-substitution component. The full scope of financial losses is not established in any of the three sources covering this disclosure.

The open question for defenders is whether the Tor-based C2 architecture makes takedown practically impossible. Traditional malware campaigns can be disrupted by seizing or sinkholing C2 servers. Hidden services on the Tor network are substantially harder to attribute and eliminate. Until Microsoft or another agency identifies who operates the .onion server, the infrastructure behind this campaign will remain active.